http://www.psdevwiki.com/ps3/api.php?action=feedcontributions&user=93.108.187.41&feedformat=atom PS3 Developer wiki - User contributions [en] 2024-03-29T11:44:57Z User contributions MediaWiki 1.39.6 http://www.psdevwiki.com/ps3/index.php?title=SW2-303&diff=55533 SW2-303 2020-02-03T12:39:07Z <p>93.108.187.41: /* Pinout */</p> <hr /> <div>== SW2-303 (SysCon) ==<br /> &lt;div style=&quot;float:right&quot;&gt;[[File:Syscon SW2-303.jpg|thumb|Photo of a Syscon 'SW2-303' (QFP Packaging)]]&lt;br /&gt;&lt;br /&gt;[[File:Fp128b_pin_arrangement.png|thumb|QFP Package : 128 pins&lt;br /&gt;''pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))'']] &lt;br /&gt; &lt;br /&gt;[[File:Syscon SW2-303 Unsoldered.JPG|thumb]]&lt;/div&gt;<br /> <br /> *Used on:<br /> **PS3 Slim [[CECH-25xx]] with motherboard: [[JSD-001]] or [[JTP-001]]<br /> **PS3 Slim [[CECH-30xx]] with motherboard: [[KTE-001]]<br /> <br /> *True Name: uPD78F11BB<br /> <br /> === Pinout ===<br /> {|class=&quot;wikitable&quot;<br /> ! Pin # !! Name !! Port !! Description !! STBY Voltages<br /> |-<br /> | 1 || P142/SCK20/SCL20 || || Connected to pin27 @Panasonic [[MN8647091]] || 0<br /> |-<br /> | 2 || SB_INT || || SB_INT/SYSCSINT, Connected to pinD1@SB through the resistor. ~1V @ standby (0 V?) || 0<br /> |-<br /> | 3 || BE_INT || || BE_INT/ATTENTION, pinBA17@BE connected through the NPN transistor. 3V @ standby (3.15V) || 3.15<br /> |-<br /> | 4 || || || To +12V_MAIN through the resistor and divider || 0<br /> |-<br /> | 5 || P37/POW_LED || || Connected to dual led(Green) on [[switch boards | switch board]] through the dual digital NPN trans. EMH1(SOT-563) || 0<br /> |-<br /> | 6 || P36/STBY_LED || || Connected to dual led(Red) on [[switch boards | switch board]] through the dual digital NPN trans. EMH1(SOT-563) || 3v @ standby (3.3V)<br /> |-<br /> | 7 || || || Connected to pinAA18@SB || 0<br /> |-<br /> | 8 || || || Connected to pinAA17@SB || 0<br /> |-<br /> | 9 || || || CELL BE related? || 0<br /> |-<br /> | 10 || || || || 0<br /> |-<br /> | 11 || P106 || || Connected to Backlit LEDs on [[switch boards | switch board]] || 0<br /> |-<br /> | 12 || P105 || || Connected to CONTOUR LEDs on [[switch boards | switch board]] || 0<br /> |-<br /> | 13 || P104 || || Absent element between this line and GND. Nothing else. || 0<br /> |-<br /> | 14 || || || || 0<br /> |-<br /> | 15 || INTP?? || || || 0<br /> |-<br /> | 16 || BUZZER || || || 0<br /> |-<br /> | 17 || P45/SO01 || || || 0<br /> |-<br /> | 18 || P44/SI01 || || 3v @ standby || 3.0<br /> |-<br /> | 19 || P43/SCK01 || || || 0<br /> |-<br /> | 20 || || || || 0<br /> |-<br /> | 21 || TOOL1 || || 3v @ standby || 3.0<br /> |-<br /> | 22 || TOOL0/Debugger Pin? || || (Connected to Pin 7 @ Service Connector) (0V?) || 0<br /> |-<br /> | 23 || P127/SO21 || || || 0<br /> |-<br /> | 24 || P126/THR_I2C_SDA || || Connected to pin 7 of CELL/RSX [[Thermal | temperature monitor IC's]] (SMbus I2C shared data line) || 3v @ standby (3.15)<br /> |-<br /> | 25 || P125/THR_I2C_SCL || || Connected to pin 8 of CELL/RSX [[Thermal | temperature monitor IC's]] (SMbus I2C shared clock line) || 3v @ standby (3.15)<br /> |-<br /> | 26 || RESET? || || Connected to standby voltage regulator [[Talk:Regulators | 463A]], pin 3 || <br /> |-<br /> | 27 || P124 || || Connected to the big black external oscilator 1 next to syscon. CLK -&gt; 1-2V Amplitude (32.768Khz?) || <br /> |-<br /> | 28 || P123 || || Connected to the big black external oscilator 1 next to syscon. CLK -&gt; 1-2V Amplitude (32.768Khz?) || <br /> |-<br /> | 29 || P137/FLMD0 || || 3.3v @ standby (Connected to pin 8 at Service Connector through the resistor) || 3.33<br /> |-<br /> | 30 || P122 || || Connected to a small external oscilator 2 ? || 0.8v @ standby (1.1)<br /> |-<br /> | 31 || P121 || || Connected to a small external oscilator 2 ? || 2.2v @ standby (2.4)<br /> |-<br /> | 32 || REGC || || || <br /> |-<br /> | 33 || GROUND/Vss0 || || || 0<br /> |-<br /> | 34 || GROUND/EVss0 || || || 0<br /> |-<br /> | 35 || Vdd || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 36 || EVdd0 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 37 || P60 || || 0.2v @ standby || 0<br /> |-<br /> | 38 || P61 || || 0.2v @ standby || 0<br /> |-<br /> | 39 || || || || 0<br /> |-<br /> | 40 || || || || 0<br /> |-<br /> | 41 || P31/AC IN? || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 42 || || || Connected (indirectly) to voltage regulator [[Talk:Regulators | BD9684 0906]], pin 4 || 0<br /> |-<br /> | 43 || P65 || || 3v @ standby || 3.0<br /> |-<br /> | 44 || || || || 0<br /> |-<br /> | 45 || || || || 0<br /> |-<br /> | 46 || INTP?? || || || 0<br /> |-<br /> | 47 || P76 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 48 || P75 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 49 || INTP?? || || || 0<br /> |-<br /> | 50 || P73 || || Connected to voltage regulator [[Talk:Regulators | D35653 0S25]], pin 5 (And connected to pin 3 @ Service Connector) || 0<br /> |-<br /> | 51 || || || || 0<br /> |-<br /> | 52 || || || Connected to voltage regulator [[Talk:Regulators | BD3525]], pin 12 || 0<br /> |-<br /> | 53 || || || || 0<br /> |-<br /> | 54 || || || || 0<br /> |-<br /> | 55 || || || || 0<br /> |-<br /> | 56 || GROUND/EVss1 || || || 0<br /> |-<br /> | 57 || EVdd1 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |- <br /> | 58 || || || || 0<br /> |-<br /> | 59 || || || || 0<br /> |-<br /> | 60 || || || || 0<br /> |-<br /> | 61 || || || || 0<br /> |-<br /> | 62 || || || || 0<br /> |-<br /> | 63 || || || || 0<br /> |-<br /> | 64 || || || || 0<br /> |-<br /> | 65 || || || || 0<br /> |-<br /> | 66 || INTP?? || || || 0<br /> |-<br /> | 67 || || || || 0<br /> |-<br /> | 68 || || || || 0<br /> |-<br /> | 69 || || || || 0<br /> |-<br /> | 70 || || || || 0<br /> |-<br /> | 71 || || || || 0<br /> |-<br /> | 72 || || || || 0<br /> |-<br /> | 73 || || || || 0<br /> |-<br /> | 74 || || || || 0<br /> |-<br /> | 75 || || || Connected to voltage regulator [[Talk:Regulators | Mitsumi 040 810X]], pin 5 || 0<br /> |-<br /> | 76 || P16 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 77 || P15 || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 78 || SC_RxD(RxD3/RxD2/P14) || || || 0<br /> |-<br /> | 79 || SC_TxD(TxD3/TxD2/P13) || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 80 || P12/EX26/SO00/TxD0 || || SO from Cell Slave to Syscon Master || 0<br /> |-<br /> | 81 || P11 P11/EX25/SI00/RxD0 || || SI from Syscon Master to Cell Slave || 1.2<br /> |-<br /> | 82 || P10/EX24/SCK00 || || Serial Clock || 0<br /> |-<br /> | 83 || P90 || || Chip Select || 2.0<br /> |-<br /> | 84 || P91 || || 3v @ standby || 3.0<br /> |-<br /> | 85 || || || || 0<br /> |-<br /> | 86 || || || || 0<br /> |-<br /> | 87 || || || || 0<br /> |-<br /> | 88 || P95/SCK11/SCL11 || || || 0<br /> |-<br /> | 89 || /SI11/SDA11 || || || 0<br /> |-<br /> | 90 || P97/SO11 || || || 0<br /> |-<br /> | 91 || || || || 0<br /> |-<br /> | 92 || || || Connected to voltage regulator [[Talk:Regulators | BD3527 (near FLASH)]], pin 12 || 0<br /> |-<br /> | 93 || || || || 0<br /> |-<br /> | 94 || || || || 0<br /> |-<br /> | 95 || || || Connected to voltage regulator [[Talk:Regulators | BD3527 (near USB)]], pin 12 || 0<br /> |-<br /> | 96 || || || || 0<br /> |-<br /> | 97 || P101 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 98 || || || || 0<br /> |-<br /> | 99 || || || || 0<br /> |-<br /> | 100 || P146 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 101 || GROUND || || || 0<br /> |-<br /> | 102 || || || || 0<br /> |-<br /> | 103 || || || || 0<br /> |-<br /> | 104 || || || || 0<br /> |-<br /> | 105 || || || || 0<br /> |-<br /> | 106 || || || || 0<br /> |-<br /> | 107 || || || || 0<br /> |-<br /> | 108 || || || || 0<br /> |-<br /> | 109 || P150 || || 3v @ standby || 3.0<br /> |-<br /> | 110 || P27/POW_SW_DET || || Power switch detect. Connected to [[switch boards | switch board]] || 3v @ standby (3.3) 3.3<br /> |-<br /> | 111 || P26/EJECT_SW_DET || || Eject switch detect. Connected to [[switch boards | switch board]] || 3v @ standby (3.3) 3.3<br /> |-<br /> | 112 || || || || 0<br /> |-<br /> | 113 || || || || 0<br /> |-<br /> | 114 || || || || 0<br /> |-<br /> | 115 || || || || 0<br /> |-<br /> | 116 || || || || 0<br /> |-<br /> | 117 || P20 || || (0V?) || 0<br /> |-<br /> | 118 || P130/ACDC_STBY || || || 0<br /> |-<br /> | 119 || P102 || || Connected to standby voltage regulator [[Talk:Regulators | 348A]], pins 2 and 7 || <br /> |-<br /> | 120 || || || || 0<br /> |-<br /> | 121 || P04/SCK10/SCL10 || || || 0<br /> |-<br /> | 122 || SI10/RxD1/SDA10 || || || 0<br /> |-<br /> | 123 || P02/SO10/TxD1 || || || 0<br /> |-<br /> | 124 || || || Connected to pin93 @Panasonic [[MN8647091]] || 0<br /> |-<br /> | 125 || || || || 0<br /> |-<br /> | 126 || P145/FAN_PWM || || PWM Control for the Fan. || 0<br /> |-<br /> | 127 || P144/SO20/TxD2 || || || 0<br /> |-<br /> | 128 || /SI20/RxD2/SDA20 || || Connected to pin29 @Panasonic [[MN8647091]] || 0<br /> |}<br /> {{Wikify}}<br /> <br /> <br /> {{Motherboard Components}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SW2-303&diff=55532 SW2-303 2020-02-03T12:38:37Z <p>93.108.187.41: /* SW2-303 (SysCon) */</p> <hr /> <div>== SW2-303 (SysCon) ==<br /> &lt;div style=&quot;float:right&quot;&gt;[[File:Syscon SW2-303.jpg|thumb|Photo of a Syscon 'SW2-303' (QFP Packaging)]]&lt;br /&gt;&lt;br /&gt;[[File:Fp128b_pin_arrangement.png|thumb|QFP Package : 128 pins&lt;br /&gt;''pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))'']] &lt;br /&gt; &lt;br /&gt;[[File:Syscon SW2-303 Unsoldered.JPG|thumb]]&lt;/div&gt;<br /> <br /> *Used on:<br /> **PS3 Slim [[CECH-25xx]] with motherboard: [[JSD-001]] or [[JTP-001]]<br /> **PS3 Slim [[CECH-30xx]] with motherboard: [[KTE-001]]<br /> <br /> *True Name: uPD78F11BB<br /> <br /> === Pinout ===<br /> {|class=&quot;wikitable&quot;<br /> ! Pin # !! Name !! Port !! Description !! STBY Voltages<br /> |-<br /> | 1 || P142/SCK20/SCL20 || || Connected to pin27 @Panasonic [[MN8647091]] || 0<br /> |-<br /> | 2 || P141 || || SB_INT/SYSCSINT, Connected to pinD1@SB through the resistor. ~1V @ standby (0 V?) || 0<br /> |-<br /> | 3 || P140 || || BE_INT/ATTENTION, pinBA17@BE connected through the NPN transistor. 3V @ standby (3.15V) || 3.15<br /> |-<br /> | 4 || || || To +12V_MAIN through the resistor and divider || 0<br /> |-<br /> | 5 || P37/POW_LED || || Connected to dual led(Green) on [[switch boards | switch board]] through the dual digital NPN trans. EMH1(SOT-563) || 0<br /> |-<br /> | 6 || P36/STBY_LED || || Connected to dual led(Red) on [[switch boards | switch board]] through the dual digital NPN trans. EMH1(SOT-563) || 3v @ standby (3.3V)<br /> |-<br /> | 7 || || || Connected to pinAA18@SB || 0<br /> |-<br /> | 8 || || || Connected to pinAA17@SB || 0<br /> |-<br /> | 9 || || || CELL BE related? || 0<br /> |-<br /> | 10 || || || || 0<br /> |-<br /> | 11 || P106 || || Connected to Backlit LEDs on [[switch boards | switch board]] || 0<br /> |-<br /> | 12 || P105 || || Connected to CONTOUR LEDs on [[switch boards | switch board]] || 0<br /> |-<br /> | 13 || P104 || || Absent element between this line and GND. Nothing else. || 0<br /> |-<br /> | 14 || || || || 0<br /> |-<br /> | 15 || INTP?? || || || 0<br /> |-<br /> | 16 || BUZZER || || || 0<br /> |-<br /> | 17 || P45/SO01 || || || 0<br /> |-<br /> | 18 || P44/SI01 || || 3v @ standby || 3.0<br /> |-<br /> | 19 || P43/SCK01 || || || 0<br /> |-<br /> | 20 || || || || 0<br /> |-<br /> | 21 || TOOL1 || || 3v @ standby || 3.0<br /> |-<br /> | 22 || TOOL0/Debugger Pin? || || (Connected to Pin 7 @ Service Connector) (0V?) || 0<br /> |-<br /> | 23 || P127/SO21 || || || 0<br /> |-<br /> | 24 || P126/THR_I2C_SDA || || Connected to pin 7 of CELL/RSX [[Thermal | temperature monitor IC's]] (SMbus I2C shared data line) || 3v @ standby (3.15)<br /> |-<br /> | 25 || P125/THR_I2C_SCL || || Connected to pin 8 of CELL/RSX [[Thermal | temperature monitor IC's]] (SMbus I2C shared clock line) || 3v @ standby (3.15)<br /> |-<br /> | 26 || RESET? || || Connected to standby voltage regulator [[Talk:Regulators | 463A]], pin 3 || <br /> |-<br /> | 27 || P124 || || Connected to the big black external oscilator 1 next to syscon. CLK -&gt; 1-2V Amplitude (32.768Khz?) || <br /> |-<br /> | 28 || P123 || || Connected to the big black external oscilator 1 next to syscon. CLK -&gt; 1-2V Amplitude (32.768Khz?) || <br /> |-<br /> | 29 || P137/FLMD0 || || 3.3v @ standby (Connected to pin 8 at Service Connector through the resistor) || 3.33<br /> |-<br /> | 30 || P122 || || Connected to a small external oscilator 2 ? || 0.8v @ standby (1.1)<br /> |-<br /> | 31 || P121 || || Connected to a small external oscilator 2 ? || 2.2v @ standby (2.4)<br /> |-<br /> | 32 || REGC || || || <br /> |-<br /> | 33 || GROUND/Vss0 || || || 0<br /> |-<br /> | 34 || GROUND/EVss0 || || || 0<br /> |-<br /> | 35 || Vdd || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 36 || EVdd0 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 37 || P60 || || 0.2v @ standby || 0<br /> |-<br /> | 38 || P61 || || 0.2v @ standby || 0<br /> |-<br /> | 39 || || || || 0<br /> |-<br /> | 40 || || || || 0<br /> |-<br /> | 41 || P31/AC IN? || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 42 || || || Connected (indirectly) to voltage regulator [[Talk:Regulators | BD9684 0906]], pin 4 || 0<br /> |-<br /> | 43 || P65 || || 3v @ standby || 3.0<br /> |-<br /> | 44 || || || || 0<br /> |-<br /> | 45 || || || || 0<br /> |-<br /> | 46 || INTP?? || || || 0<br /> |-<br /> | 47 || P76 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 48 || P75 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 49 || INTP?? || || || 0<br /> |-<br /> | 50 || P73 || || Connected to voltage regulator [[Talk:Regulators | D35653 0S25]], pin 5 (And connected to pin 3 @ Service Connector) || 0<br /> |-<br /> | 51 || || || || 0<br /> |-<br /> | 52 || || || Connected to voltage regulator [[Talk:Regulators | BD3525]], pin 12 || 0<br /> |-<br /> | 53 || || || || 0<br /> |-<br /> | 54 || || || || 0<br /> |-<br /> | 55 || || || || 0<br /> |-<br /> | 56 || GROUND/EVss1 || || || 0<br /> |-<br /> | 57 || EVdd1 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |- <br /> | 58 || || || || 0<br /> |-<br /> | 59 || || || || 0<br /> |-<br /> | 60 || || || || 0<br /> |-<br /> | 61 || || || || 0<br /> |-<br /> | 62 || || || || 0<br /> |-<br /> | 63 || || || || 0<br /> |-<br /> | 64 || || || || 0<br /> |-<br /> | 65 || || || || 0<br /> |-<br /> | 66 || INTP?? || || || 0<br /> |-<br /> | 67 || || || || 0<br /> |-<br /> | 68 || || || || 0<br /> |-<br /> | 69 || || || || 0<br /> |-<br /> | 70 || || || || 0<br /> |-<br /> | 71 || || || || 0<br /> |-<br /> | 72 || || || || 0<br /> |-<br /> | 73 || || || || 0<br /> |-<br /> | 74 || || || || 0<br /> |-<br /> | 75 || || || Connected to voltage regulator [[Talk:Regulators | Mitsumi 040 810X]], pin 5 || 0<br /> |-<br /> | 76 || P16 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 77 || P15 || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 78 || SC_RxD(RxD3/RxD2/P14) || || || 0<br /> |-<br /> | 79 || SC_TxD(TxD3/TxD2/P13) || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 80 || P12/EX26/SO00/TxD0 || || SO from Cell Slave to Syscon Master || 0<br /> |-<br /> | 81 || P11 P11/EX25/SI00/RxD0 || || SI from Syscon Master to Cell Slave || 1.2<br /> |-<br /> | 82 || P10/EX24/SCK00 || || Serial Clock || 0<br /> |-<br /> | 83 || P90 || || Chip Select || 2.0<br /> |-<br /> | 84 || P91 || || 3v @ standby || 3.0<br /> |-<br /> | 85 || || || || 0<br /> |-<br /> | 86 || || || || 0<br /> |-<br /> | 87 || || || || 0<br /> |-<br /> | 88 || P95/SCK11/SCL11 || || || 0<br /> |-<br /> | 89 || /SI11/SDA11 || || || 0<br /> |-<br /> | 90 || P97/SO11 || || || 0<br /> |-<br /> | 91 || || || || 0<br /> |-<br /> | 92 || || || Connected to voltage regulator [[Talk:Regulators | BD3527 (near FLASH)]], pin 12 || 0<br /> |-<br /> | 93 || || || || 0<br /> |-<br /> | 94 || || || || 0<br /> |-<br /> | 95 || || || Connected to voltage regulator [[Talk:Regulators | BD3527 (near USB)]], pin 12 || 0<br /> |-<br /> | 96 || || || || 0<br /> |-<br /> | 97 || P101 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 98 || || || || 0<br /> |-<br /> | 99 || || || || 0<br /> |-<br /> | 100 || P146 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 101 || GROUND || || || 0<br /> |-<br /> | 102 || || || || 0<br /> |-<br /> | 103 || || || || 0<br /> |-<br /> | 104 || || || || 0<br /> |-<br /> | 105 || || || || 0<br /> |-<br /> | 106 || || || || 0<br /> |-<br /> | 107 || || || || 0<br /> |-<br /> | 108 || || || || 0<br /> |-<br /> | 109 || P150 || || 3v @ standby || 3.0<br /> |-<br /> | 110 || P27/POW_SW_DET || || Power switch detect. Connected to [[switch boards | switch board]] || 3v @ standby (3.3) 3.3<br /> |-<br /> | 111 || P26/EJECT_SW_DET || || Eject switch detect. Connected to [[switch boards | switch board]] || 3v @ standby (3.3) 3.3<br /> |-<br /> | 112 || || || || 0<br /> |-<br /> | 113 || || || || 0<br /> |-<br /> | 114 || || || || 0<br /> |-<br /> | 115 || || || || 0<br /> |-<br /> | 116 || || || || 0<br /> |-<br /> | 117 || P20 || || (0V?) || 0<br /> |-<br /> | 118 || P130/ACDC_STBY || || || 0<br /> |-<br /> | 119 || P102 || || Connected to standby voltage regulator [[Talk:Regulators | 348A]], pins 2 and 7 || <br /> |-<br /> | 120 || || || || 0<br /> |-<br /> | 121 || P04/SCK10/SCL10 || || || 0<br /> |-<br /> | 122 || SI10/RxD1/SDA10 || || || 0<br /> |-<br /> | 123 || P02/SO10/TxD1 || || || 0<br /> |-<br /> | 124 || || || Connected to pin93 @Panasonic [[MN8647091]] || 0<br /> |-<br /> | 125 || || || || 0<br /> |-<br /> | 126 || P145/FAN_PWM || || PWM Control for the Fan. || 0<br /> |-<br /> | 127 || P144/SO20/TxD2 || || || 0<br /> |-<br /> | 128 || /SI20/RxD2/SDA20 || || Connected to pin29 @Panasonic [[MN8647091]] || 0<br /> |}<br /> {{Wikify}}<br /> <br /> <br /> {{Motherboard Components}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Talk:CXR713F120A&diff=55490 Talk:CXR713F120A 2020-01-30T18:26:22Z <p>93.108.187.41: </p> <hr /> <div>&lt;gallery&gt;<br /> File:CXR713F120A_No_Chip_STBY.png|[[CXR713F120A]] STANDBY<br /> &lt;/gallery&gt;<br /> <br /> = Other Chips =<br /> <br /> &lt;pre&gt;<br /> Sony Computer<br /> Entertainment Inc.<br /> CXR713F120A<br /> ©&amp;M2005SCEI<br /> GB-004<br /> ES1 47H<br /> &lt;/pre&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55454 SC Communication 2020-01-27T14:58:18Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> 03 SERV_SDA<br /> 10 SERV_DEVPM<br /> 11 SERV_THERM<br /> 12 SERV_SETCFG<br /> 13 SERV_SYSPM<br /> 14 SERV_NVS<br /> 15 SERV_SIRCS<br /> 16 SERV_NOTIF<br /> 17 SERV_INTR_NOTIF<br /> 18 SERV_VERS<br /> 1B SERV_LIVELOCK<br /> 1C SERV_OSWDT<br /> 1E SERV_DIAG<br /> 1F SERV_SECU<br /> 20 SERV_CONSOLE<br /> 2D SERV_PATCH<br /> 30 SERV_HDMI<br /> 40 SERV_LS<br /> 50 SERV_STORAGE<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x1E || Diag Service<br /> |-<br /> | 0x20 || Syscon Console Output - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Service<br /> |-<br /> | 0x30 || A/V Service / HDMI Service<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Secure Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55453 SC Communication 2020-01-27T14:57:48Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> 03 SERV_SDA<br /> 10 SERV_DEVPM<br /> 11 SERV_THERM<br /> 12 SERV_SETCFG<br /> 13 SERV_SYSPM<br /> 14 SERV_NVS<br /> 15 SERV_SIRCS<br /> 16 SERV_NOTIF<br /> 17 SERV_INTR_NOTIF<br /> 18 SERV_VERS<br /> 1B SERV_LIVELOCK<br /> 1C SERV_OSWDT<br /> 1E SERV_DIAG<br /> 1F SERV_SECU<br /> 20 SERV_CONSOLE<br /> 2D SERV_PATCH<br /> 30 SERV_HDMI<br /> 40 SERV_LS<br /> 50 SERV_STORAGE<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x1E || Diag Service<br /> |-<br /> | 0x20 || Syscon Console Output - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Service<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Secure Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55452 SC Communication 2020-01-27T14:57:00Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> 03 SERV_SDA<br /> 10 SERV_DEVPM<br /> 11 SERV_THERM<br /> 12 SERV_SETCFG<br /> 13 SERV_SYSPM<br /> 14 SERV_NVS<br /> 15 SERV_SIRCS<br /> 16 SERV_NOTIF<br /> 17 SERV_INTR_NOTIF<br /> 18 SERV_VERS<br /> 1B SERV_LIVELOCK<br /> 1C SERV_OSWDT<br /> 1E SERV_DIAG<br /> 1F SERV_SECU<br /> 20 SERV_CONSOLE<br /> 2D SERV_PATCH<br /> 30 SERV_HDMI<br /> 40 SERV_LS<br /> 50 SERV_STORAGE<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x1E || Diag Service<br /> |-<br /> | 0x20 || Syscon Console Output - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Secure Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55451 SC Communication 2020-01-27T14:55:30Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> 03 SERV_SDA<br /> 10 SERV_DEVPM<br /> 11 SERV_THERM<br /> 12 SERV_SETCFG<br /> 13 SERV_SYSPM<br /> 14 SERV_NVS<br /> 15 SERV_SIRCS<br /> 16 SERV_NOTIF<br /> 17 SERV_INTR_NOTIF<br /> 18 SERV_VERS<br /> 1B SERV_LIVELOCK<br /> 1C SERV_OSWDT<br /> 1E SERV_DIAG<br /> 1F SERV_SECU<br /> 20 SERV_CONSOLE<br /> 2D SERV_PATCH<br /> 30 SERV_HDMI<br /> 40 SERV_LS<br /> 50 SERV_STORAGE<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x20 || Syscon Console Output - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Secure Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55450 SC Communication 2020-01-27T14:54:37Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> 03 SERV_SDA<br /> 10 SERV_DEVPM<br /> 11 SERV_THERM<br /> 12 SERV_SETCFG<br /> 13 SERV_SYSPM<br /> 14 SERV_NVS<br /> 15 SERV_SIRCS<br /> 16 SERV_NOTIF<br /> 17 SERV_INTR_NOTIF<br /> 18 SERV_VERS<br /> 1B SERV_LIVELOCK<br /> 1C SERV_OSWDT<br /> 1E SERV_DIAG<br /> 1F SERV_SECU<br /> 20 SERV_CONSOLE<br /> 2D SERV_PATCH<br /> 30 SERV_HDMI<br /> 40 SERV_LS<br /> 50 SERV_STORAGE<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x20 || Syscon Console Output - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55449 SC Communication 2020-01-27T14:53:49Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> 03 SERV_SDA<br /> 10 SERV_DEVPM<br /> 11 SERV_THERM<br /> 12 SERV_SETCFG<br /> 13 SERV_SYSPM<br /> 14 SERV_NVS<br /> 15 SERV_SIRCS<br /> 16 SERV_NOTIF<br /> 17 SERV_INTR_NOTIF<br /> 18 SERV_VERS<br /> 1B SERV_LIVELOCK<br /> 1C SERV_OSWDT<br /> 1E SERV_DIAG<br /> 1F SERV_SECU<br /> 20 SERV_CONSOLE<br /> 2D SERV_PATCH<br /> 30 SERV_HDMI<br /> 40 SERV_LS<br /> 50 SERV_STORAGE<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55448 SC Communication 2020-01-27T14:44:01Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x17 || Interrupt Notification Service<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55447 SC Communication 2020-01-27T14:43:15Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x40 || LS (Local Storage) ??<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55446 SC Communication 2020-01-27T14:42:14Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x1C || OSWDT ??<br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55445 SC Communication 2020-01-27T14:41:31Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x15 || SIRCS ??<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55444 SC Communication 2020-01-27T14:40:47Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55443 SC Communication 2020-01-27T14:40:01Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x16 || LED / Buzzer Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55442 SC Communication 2020-01-27T14:39:11Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || PS2 PCI Bus Power On/Off<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x16 || LED / Buzzer Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || Syscon Patch Servuce<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x50 || Storage Service<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_Communication&diff=55441 SC Communication 2020-01-27T14:38:16Z <p>93.108.187.41: /* Syscon Services */</p> <hr /> <div>=Introduction=<br /> <br /> * The following information was reverse engineered from [[lv0ldr]], [[lv0]], [[Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29|lv1]].[[SC_Manager|self]], and [[Iso module]] sc_iso.self.<br /> * Big thanks to graf_chokolo for a large part of the basis of this page, and to Jestero for Syscon Authentication info!<br /> <br /> =Overview of Syscon Communication=<br /> <br /> *Syscon lives at the mmio space of 0x24000080000.<br /> *Communication occurs through mmio read/writes.<br /> <br /> List of known offsets in Syscon:<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset (from start of address space) !! Size !! Description<br /> |-<br /> |0xC000 || 0xFF0 || Syscon packet send area<br /> |-<br /> |0xCFF0 || 0x4 || Syscon sent packet counter<br /> |-<br /> |0xCFF4 || 0x4 || Syscon sent packet acknowledge counter<br /> |-<br /> |0xD000 || 0xFF0 || Syscon packet receive area<br /> |-<br /> |0xDFF0 || 0x4 || Syscon received packet counter<br /> |-<br /> |0xDFF4 || 0x4 || Syscon received packet acknowledge counter<br /> |-<br /> |0xE100 || 0x4 || Tells syscon there is a packet to be received<br /> |}<br /> <br /> Quick explanation of the packet counters:<br /> * There are two counters that are incremented by each side (Cell / Syscon).<br /> * 0xCFF0 and 0xDFF0 are incremented by the sending side (Syscon for 0xCFF0, Cell for 0xDFF0)<br /> * 0xCFF4 and 0xDFF4 are incremented by the receiving side (Cell for 0xCFF4, Syscon for 0xDFF4)<br /> <br /> =Syscon Services=<br /> * To be completed... (see {{talk}} page for examples)<br /> <br /> &lt;pre&gt;<br /> SERV_INTR_NOTIF 0x17<br /> SERV_LS 0x40<br /> SERV STORAGE 0x50<br /> SERV_Patch 0x2D<br /> SERV VERS 0x18<br /> SERV LIVELOCK 0x1B<br /> SERV OSWDT 0x1C<br /> SERV SIRCS 0x15<br /> SERV NOTIF 0x16<br /> SERV NVS 0x14<br /> SERV DEVPM 0x10<br /> SERV SETCFG 0x12<br /> SERV SDA 0x3<br /> SERV SYSPM 0x13<br /> &lt;/pre&gt;<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Service ID !! Description<br /> |-<br /> | 0x03 || Device Access Service - Used for eeprom read/write.<br /> |-<br /> | 0x10 || PS2 PCI Bus Power On/Off<br /> |-<br /> | 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode, <br /> |-<br /> | 0x12 || Config Info Service (BE Count, Error Log....)<br /> |-<br /> | 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)<br /> |-<br /> | 0x14 || NVS Service - Used for eeprom read/write.<br /> |-<br /> | 0x16 || LED / Buzzer Service - Controls the lights on the console and the ring buzzer.<br /> |-<br /> | 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)<br /> |-<br /> | 0x1B || Livelock(?) Service - Checks for permission to use other services. <br /> |-<br /> | 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.<br /> |-<br /> | 0x2D || (used when getting Patch/ROM Version in EPROM)<br /> |-<br /> | 0x30 || A/V Service.<br /> |-<br /> | 0x1F || Authenticated Services. (sc_secure_service)<br /> |-<br /> | 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])<br /> |}<br /> <br /> =Syscon Packet Headers=<br /> * Some useful packet headers...<br /> * If the header is shorter than 0x10, you must add your own size.<br /> * If greater than 0x10, it's a full packet ;)<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! What? !! Description || Data || Notes<br /> |-<br /> | AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00<br /> |-<br /> | Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00&lt;br&gt;|| Start message with 0x00. Will print as much as packet length.<br /> |-<br /> | Triple Beep || || 0x16, 0x01, 0x16, 0x20, 0x00, 0x00, 0x80, 0x4D, 0x00, 0x00, 0x00, 0x01,&lt;br&gt;0x00, 0x08, 0x00, 0x08,&lt;br&gt;0x20, 0x29, 0x0A, 0x00, 0x00, 0x00, 0x01, 0xB6||<br /> |-<br /> | Shutdown || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x00|| Will not gracefully shut down HD.<br /> |-<br /> | Soft Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x01|| Restarts, but doesn't kill power between boots.<br /> |-<br /> | Hard Restart || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x02|| Restarts, but kills power between boots.<br /> |-<br /> | Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,&lt;br&gt;0x00, 0x04, 0x00, 0x04,&lt;br&gt;0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.<br /> |}<br /> <br /> =Syscon Authentication=<br /> - An IV of 0x00 is used for most AES steps.<br /> <br /> == Step 1 - Generate Individual Seeds ==<br /> Encrypt sc_iso metadata seeds w/ eid root key / iv.<br /> <br /> &lt;pre&gt;aes256cbc_enc(eid_root_erk, eid_root_riv, sc_module_seeds, 0x40, sc_module_seeds);&lt;/pre&gt;<br /> <br /> == Step 2 - Generate SC_ISO encrypted keys ==<br /> Encrypt the sc_key_seeds.<br /> <br /> &lt;pre&gt;<br /> indiv_key = sc_module_seeds + 0x20;<br /> for (int i = 0; i &lt; 0x100; i += 0x10)<br /> aes256cbc_enc(indiv_key, zero_iv, key_seeds + i, 0x10, enc_key_seeds + i);<br /> &lt;/pre&gt;<br /> <br /> == Step 3 - Authenticate with Syscon ==<br /> Pick a session_id. Must be &lt;= 7.<br /> <br /> === Step 3a - Secure Packet Header ===<br /> &lt;pre&gt;<br /> struct secure_payload_header {<br /> u8 session_id;<br /> u8 seq_service_id; //service_ID (Unsecure uses 0xFF, AUTH1 = 0x02, AUTH2 = 0x03, READ_DATA = 0x04, WRITE_DATA = 0x05)<br /> u8 packet_type; //0xFF for BE-&gt;SC, 0x00 for SC-&gt;BE (if success)<br /> u8 magic[0x2]; //0xAD1A<br /> u8 prng_random[0xB] //Random shit for padding<br /> };<br /> &lt;/pre&gt;<br /> <br /> === Step 3b - AUTH 1 to SC ===<br /> &lt;pre&gt;<br /> uint8_t random_shit[0x10];<br /> auth_key_1_0x01 = enc_key_seeds + (session_id * (0x10*2));<br /> auth_key_2_0x01 = enc_key_seeds + (session_id * (0x10*2) + 0x10);<br /> <br /> //generating random payload for auth1<br /> rnd_gen(random_shit, 0x10);<br /> <br /> //create auth1 random data<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, random_shit, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth1_pkt_header, 0x10);<br /> <br /> //Send packet. 0x40 Bytes<br /> &lt;/pre&gt;<br /> <br /> === Step 3c - Validate AUTH1 ===<br /> First, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> Then check the AUTH1 response<br /> &lt;pre&gt;<br /> // decrypt secure_payload<br /> for (i = 0x0; i &lt; 0x20; i += 0x10)<br /> aes128cbc(auth_key_2_0x01, zero_iv, secure_payload_buf + 0x10 + i, 0x10, secure_payload_buf + 0x10 + i);<br /> <br /> // check if challange returned from syscon is correct<br /> res = memcmp(secure_payload_buf + 0x10, random_shit, 0x10);<br /> if (res != 0)<br /> return -1;<br /> <br /> // save the new challange needed for AUTH2<br /> memcpy(auth_challenge, secure_payload_buf + 0x20, 0x10);<br /> &lt;/pre&gt;<br /> <br /> === Step 3d - AUTH2 to SC ===<br /> &lt;pre&gt;<br /> //AUTH2 Challenge Payload<br /> aes128cbc_enc(auth_key_1_0x01, zero_iv, auth_challenge, 0x10, secure_payload_buf + 0x10);<br /> <br /> //length = 0x20<br /> //Create secure header/footer<br /> // create header: 5 bytes + random stuff (0xb)<br /> payload_header-&gt;session_id = session_id;<br /> payload_header-&gt;seq_service_id = seq_service_id++; // starts at 0<br /> payload_header-&gt;packet_type = 0xFF;<br /> payload_header-&gt;magic[0] = 0xAD;<br /> payload_header-&gt;magic[1] = 0x1A;<br /> rnd_gen((u8*) &amp;payload_header-&gt;prng_random, 0x0B);<br /> <br /> //encrypt payload<br /> aes128cbc_enc(be2sc_key, zero_iv, secure_payload_buf, length, secure_payload_buf);<br /> <br /> // create footer: omac1 of the whole packet<br /> aesOmac1Mode(secure_payload_buf + length, secure_payload_buf, length, be2sc_key, sizeof(be2sc_key)*8);<br /> <br /> //Set regular header<br /> memcpy(sc_packet, auth2_pkt_header, 0x10);<br /> <br /> //Put packet - 0x40 packet length<br /> &lt;/pre&gt;<br /> <br /> === Step 3e - Validate AUTH2 ===<br /> Again, check the header/footer.<br /> * Calculate AES [http://en.wikipedia.org/wiki/One-key_MAC OMAC] over the packet length and compare to [http://en.wikipedia.org/wiki/One-key_MAC OMAC] from syscon. Use sc2be key.<br /> * Decrypt internal packet with sc2be key. Use AES128-CBC<br /> * Compare returned session_id and seq_service_id.<br /> * Check secure_payload_buf[0x2] == 0.<br /> <br /> &lt;pre&gt;<br /> // encrypt random_shit using auth_challenge (returned from AUTH1 reply) as key and 0 IV<br /> aes128cbc_enc(auth_challenge, zero_iv, random_shit, 0x10, session_key);<br /> <br /> // encrypt result in place with session_key_create[0x10 * sess_id] and IV 0 (result will be the session_key)<br /> aes128cbc_enc(session_key_create + (session_id * 0x10), zero_iv, session_key, 0x10, session_key);<br /> <br /> // use the session_key to decrypt auth2_payload in place (0x10)<br /> aes128cbc(session_key, zero_iv, secure_payload_buf + 0x10, 0x10, secure_payload_buf + 0x10);<br /> <br /> // compare the result with a 0x10 zero string<br /> res = memcmp(secure_payload_buf + 0x10, zero_iv, 0x10);<br /> <br /> //res == 0x0 is good.<br /> &lt;/pre&gt;<br /> <br /> == Step 4 - Profit? ==<br /> You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.<br /> <br /> <br /> = Some Samples from DYN-001 Syscon SPI SC Comms =<br /> <br /> * https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM<br /> <br /> &lt;pre&gt;<br /> 00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1 <br /> E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC <br /> F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88<br /> &lt;/pre&gt;<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SW2-303&diff=55346 SW2-303 2020-01-16T13:18:27Z <p>93.108.187.41: /* Pinout */</p> <hr /> <div>== SW2-303 (SysCon) ==<br /> &lt;div style=&quot;float:right&quot;&gt;[[File:Syscon SW2-303.jpg|thumb|Photo of a Syscon 'SW2-303' (QFP Packaging)]]&lt;br /&gt;&lt;br /&gt;[[File:Fp128b_pin_arrangement.png|thumb|QFP Package : 128 pins&lt;br /&gt;''pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))'']] &lt;br /&gt; &lt;br /&gt;[[File:Syscon SW2-303 Unsoldered.JPG|thumb]]&lt;/div&gt;<br /> <br /> *Used on:<br /> **PS3 Slim [[CECH-25xx]] with motherboard: [[JSD-001]] or [[JTP-001]]<br /> **PS3 Slim [[CECH-30xx]] with motherboard: [[KTE-001]]<br /> <br /> *True Name: uPD78F11BB<br /> <br /> === Pinout ===<br /> {|class=&quot;wikitable&quot;<br /> ! Pin # !! Name !! Port !! Description !! STBY Voltages<br /> |-<br /> | 1 || P142/SCK20/SCL20 || || Connected to pin27 @Panasonic [[MN8647091]] || 0<br /> |-<br /> | 2 || P141 || || Connected to pinD1@SB through the resistor. ~1V @ standby (0 V?) || 0<br /> |-<br /> | 3 || P140 || || pinBA17@BE connected through the NPN transistor. 3V @ standby (3.15V) || 3.15<br /> |-<br /> | 4 || || || To +12V_MAIN through the resistor and divider || 0<br /> |-<br /> | 5 || P37/POW_LED || || Connected to dual led(Green) on [[switch boards | switch board]] through the dual digital NPN trans. EMH1(SOT-563) || 0<br /> |-<br /> | 6 || P36/STBY_LED || || Connected to dual led(Red) on [[switch boards | switch board]] through the dual digital NPN trans. EMH1(SOT-563) || 3v @ standby (3.3V)<br /> |-<br /> | 7 || || || Connected to pinAA18@SB || 0<br /> |-<br /> | 8 || || || Connected to pinAA17@SB || 0<br /> |-<br /> | 9 || || || CELL BE related? || 0<br /> |-<br /> | 10 || || || || 0<br /> |-<br /> | 11 || P106 || || Connected to Backlit LEDs on [[switch boards | switch board]] || 0<br /> |-<br /> | 12 || P105 || || Connected to CONTOUR LEDs on [[switch boards | switch board]] || 0<br /> |-<br /> | 13 || P104 || || Absent element between this line and GND. Nothing else. || 0<br /> |-<br /> | 14 || || || || 0<br /> |-<br /> | 15 || || || || 0<br /> |-<br /> | 16 || BUZZER || || || 0<br /> |-<br /> | 17 || P45/SO01 || || || 0<br /> |-<br /> | 18 || P44/SI01 || || 3v @ standby || 3.0<br /> |-<br /> | 19 || P43/SCK01 || || || 0<br /> |-<br /> | 20 || || || || 0<br /> |-<br /> | 21 || TOOL1 || || 3v @ standby || 3.0<br /> |-<br /> | 22 || TOOL0/Debugger Pin? || || (Connected to Pin 7 @ Service Connector) (0V?) || 0<br /> |-<br /> | 23 || P127/SO21 || || || 0<br /> |-<br /> | 24 || P126/THR_I2C_SDA || || Connected to pin 7 of CELL/RSX [[Thermal | temperature monitor IC's]] (SMbus I2C shared data line) || 3v @ standby (3.15)<br /> |-<br /> | 25 || P125/THR_I2C_SCL || || Connected to pin 8 of CELL/RSX [[Thermal | temperature monitor IC's]] (SMbus I2C shared clock line) || 3v @ standby (3.15)<br /> |-<br /> | 26 || RESET? || || Connected to standby voltage regulator [[Talk:Regulators | 463A]], pin 3 || <br /> |-<br /> | 27 || P124 || || Connected to the big black external oscilator 1 next to syscon. CLK -&gt; 1-2V Amplitude (32.768Khz?) || <br /> |-<br /> | 28 || P123 || || Connected to the big black external oscilator 1 next to syscon. CLK -&gt; 1-2V Amplitude (32.768Khz?) || <br /> |-<br /> | 29 || P137/FLMD0 || || 3.3v @ standby (Connected to pin 8 at Service Connector through the resistor) || 3.33<br /> |-<br /> | 30 || P122 || || Connected to a small external oscilator 2 ? || 0.8v @ standby (1.1)<br /> |-<br /> | 31 || P121 || || Connected to a small external oscilator 2 ? || 2.2v @ standby (2.4)<br /> |-<br /> | 32 || REGC || || || <br /> |-<br /> | 33 || GROUND/Vss0 || || || 0<br /> |-<br /> | 34 || GROUND/EVss0 || || || 0<br /> |-<br /> | 35 || Vdd || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 36 || EVdd0 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 37 || P60 || || 0.2v @ standby || 0<br /> |-<br /> | 38 || P61 || || 0.2v @ standby || 0<br /> |-<br /> | 39 || || || || 0<br /> |-<br /> | 40 || || || || 0<br /> |-<br /> | 41 || P31/AC IN? || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 42 || || || Connected (indirectly) to voltage regulator [[Talk:Regulators | BD9684 0906]], pin 4 || 0<br /> |-<br /> | 43 || P65 || || 3v @ standby || 3.0<br /> |-<br /> | 44 || || || || 0<br /> |-<br /> | 45 || || || || 0<br /> |-<br /> | 46 || || || || 0<br /> |-<br /> | 47 || P76 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 48 || P75 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 49 || || || || 0<br /> |-<br /> | 50 || P73 || || Connected to voltage regulator [[Talk:Regulators | D35653 0S25]], pin 5 (And connected to pin 3 @ Service Connector) || 0<br /> |-<br /> | 51 || || || || 0<br /> |-<br /> | 52 || || || Connected to voltage regulator [[Talk:Regulators | BD3525]], pin 12 || 0<br /> |-<br /> | 53 || || || || 0<br /> |-<br /> | 54 || || || || 0<br /> |-<br /> | 55 || || || || 0<br /> |-<br /> | 56 || GROUND/EVss1 || || || 0<br /> |-<br /> | 57 || EVdd1 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |- <br /> | 58 || || || || 0<br /> |-<br /> | 59 || || || || 0<br /> |-<br /> | 60 || || || || 0<br /> |-<br /> | 61 || || || || 0<br /> |-<br /> | 62 || || || || 0<br /> |-<br /> | 63 || || || || 0<br /> |-<br /> | 64 || || || || 0<br /> |-<br /> | 65 || || || || 0<br /> |-<br /> | 66 || || || || 0<br /> |-<br /> | 67 || || || || 0<br /> |-<br /> | 68 || || || || 0<br /> |-<br /> | 69 || || || || 0<br /> |-<br /> | 70 || || || || 0<br /> |-<br /> | 71 || || || || 0<br /> |-<br /> | 72 || || || || 0<br /> |-<br /> | 73 || || || || 0<br /> |-<br /> | 74 || || || || 0<br /> |-<br /> | 75 || || || Connected to voltage regulator [[Talk:Regulators | Mitsumi 040 810X]], pin 5 || 0<br /> |-<br /> | 76 || P16 || || 3v @ standby (3.15) || 3.15<br /> |-<br /> | 77 || P15 || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 78 || SC_RxD(RxD3/RxD2/P14) || || || 0<br /> |-<br /> | 79 || SC_TxD(TxD3/TxD2/P13) || || 3v @ standby (3.3) || 3.3<br /> |-<br /> | 80 || P12/EX26/SO00/TxD0 || || SO from Cell Slave to Syscon Master || 0<br /> |-<br /> | 81 || P11 P11/EX25/SI00/RxD0 || || SI from Syscon Master to Cell Slave || 1.2<br /> |-<br /> | 82 || P10/EX24/SCK00 || || Serial Clock || 0<br /> |-<br /> | 83 || P90 || || Chip Select || 2.0<br /> |-<br /> | 84 || P91 || || 3v @ standby || 3.0<br /> |-<br /> | 85 || || || || 0<br /> |-<br /> | 86 || || || || 0<br /> |-<br /> | 87 || || || || 0<br /> |-<br /> | 88 || P95/SCK11/SCL11 || || || 0<br /> |-<br /> | 89 || /SI11/SDA11 || || || 0<br /> |-<br /> | 90 || P97/SO11 || || || 0<br /> |-<br /> | 91 || || || || 0<br /> |-<br /> | 92 || || || Connected to voltage regulator [[Talk:Regulators | BD3527 (near FLASH)]], pin 12 || 0<br /> |-<br /> | 93 || || || || 0<br /> |-<br /> | 94 || || || || 0<br /> |-<br /> | 95 || || || Connected to voltage regulator [[Talk:Regulators | BD3527 (near USB)]], pin 12 || 0<br /> |-<br /> | 96 || || || || 0<br /> |-<br /> | 97 || P101 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 98 || || || || 0<br /> |-<br /> | 99 || || || || 0<br /> |-<br /> | 100 || P146 || || Connected to voltage regulator [[Talk:Regulators | 463A]], pin 2 (3.3_EVER_B) || 3v @ standby (3.3)<br /> |-<br /> | 101 || GROUND || || || 0<br /> |-<br /> | 102 || || || || 0<br /> |-<br /> | 103 || || || || 0<br /> |-<br /> | 104 || || || || 0<br /> |-<br /> | 105 || || || || 0<br /> |-<br /> | 106 || || || || 0<br /> |-<br /> | 107 || || || || 0<br /> |-<br /> | 108 || || || || 0<br /> |-<br /> | 109 || P150 || || 3v @ standby || 3.0<br /> |-<br /> | 110 || P27/POW_SW_DET || || Power switch detect. Connected to [[switch boards | switch board]] || 3v @ standby (3.3) 3.3<br /> |-<br /> | 111 || P26/EJECT_SW_DET || || Eject switch detect. Connected to [[switch boards | switch board]] || 3v @ standby (3.3) 3.3<br /> |-<br /> | 112 || || || || 0<br /> |-<br /> | 113 || || || || 0<br /> |-<br /> | 114 || || || || 0<br /> |-<br /> | 115 || || || || 0<br /> |-<br /> | 116 || || || || 0<br /> |-<br /> | 117 || P20 || || (0V?) || 0<br /> |-<br /> | 118 || P130/ACDC_STBY || || || 0<br /> |-<br /> | 119 || P102 || || Connected to standby voltage regulator [[Talk:Regulators | 348A]], pins 2 and 7 || <br /> |-<br /> | 120 || || || || 0<br /> |-<br /> | 121 || P04/SCK10/SCL10 || || || 0<br /> |-<br /> | 122 || SI10/RxD1/SDA10 || || || 0<br /> |-<br /> | 123 || P02/SO10/TxD1 || || || 0<br /> |-<br /> | 124 || || || Connected to pin93 @Panasonic [[MN8647091]] || 0<br /> |-<br /> | 125 || || || || 0<br /> |-<br /> | 126 || P145/FAN_PWM || || PWM Control for the Fan. || 0<br /> |-<br /> | 127 || P144/SO20/TxD2 || || || 0<br /> |-<br /> | 128 || /SI20/RxD2/SDA20 || || Connected to pin29 @Panasonic [[MN8647091]] || 0<br /> |}<br /> {{Wikify}}<br /> <br /> <br /> {{Motherboard Components}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Syscon_Firmware&diff=54931 Syscon Firmware 2019-12-20T16:09:01Z <p>93.108.187.41: /* External commands */</p> <hr /> <div>Syscon Firmware is the firmware stored on the System Controller EEPROM (see [[Syscon Hardware]]). Updates are stored in update packages within the Update_files.tar of a [[Playstation Update Package (PUP)]]. Syscon Packages appear to always be 5KB (5376 bytes) in size.<br /> <br /> <br /> = Syscon update packages =<br /> d/l: [http://www.multiupload.com/JHBCOCGNUR syscon_fw1.00-4.00.rar (51.74 KB)]<br /> <br /> == Package structure ==<br /> Sys_con_firmware Packages can be unpacked with unpkg<br /> <br /> === Overview ===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || ASCI:&quot;SCE&quot; || SCE magic header<br /> |-<br /> | 0x04 || 0x4 || 0x2 || Flags<br /> |-<br /> | 0x08 || 0x4 || 0x3 || Type (0x3 = PKG)<br /> |-<br /> | 0x0C || 0x4 || 0x0 || Blank/Unknown<br /> |-<br /> | 0x10 || 0x4 || 0x0 || Blank/Unknown<br /> |-<br /> | 0x10 || 0x8 || 0x280 || Start Data Offset ('hdr_len')<br /> |-<br /> | 0x18 || 0x8 || 0x1080 || Data Size ('dec_size')<br /> |-<br /> | 0x20 || 0x260 || - || Header<br /> |-<br /> | 0x280 || 0x40 || - || 'info0' section (see below)<br /> |-<br /> | 0x2C0 || 0x40 || - || 'info1' section (see below)<br /> |-<br /> | 0x300 || 0x1000 || - || 'content'<br /> |-<br /> |}<br /> ==='info0'===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || 0x3 || <br /> |-<br /> | 0x04 || 0x4 || 0x8 || <br /> |-<br /> | 0x08 || 0x8 || - || SC firmware revision (the high word of it is the SC type)<br /> |-<br /> | 0x0C || 0x4 || 0x0B8E(1.30-4.84)&lt;br /&gt;0x0C16(1.81-4.84)&lt;br /&gt;0x0D52(3.40-4.84)&lt;br /&gt;0x0DBF(3.40-4.84)&lt;br /&gt;0x0E69(3.40-4.84)&lt;br /&gt;0x0F29(3.40-4.84)&lt;br /&gt;0x0F38(3.41-4.84)&lt;br /&gt;0x065D&lt;br /&gt;0x0832(3.00-4.84)&lt;br /&gt;0x08A0&lt;br /&gt;0x08C2&lt;br /&gt;0x0918 || 'SoftID'<br /> |-<br /> | 0x10 || 0x8 || 0x0001000000000004&lt;br /&gt;0x0001000000000005&lt;br /&gt;0x0001000000000006&lt;br /&gt;0x0001000100030002&lt;br /&gt;0x0001000100030003&lt;br /&gt;0x0001000200030002&lt;br /&gt;0x0001000300030002&lt;br /&gt;0x0001000400040002&lt;br /&gt;0x0001000500000002&lt;br /&gt;0x0001000500010001&lt;br /&gt;0x00010002083E0832&lt;br /&gt; || 'PatchID'<br /> |-<br /> | 0x18 || 0x8 || 0x1000 || 'Content' Data Size<br /> |-<br /> | 0x20 || 0x8 || 0x1000 || 'Content' Compressed Data Size<br /> |-<br /> | 0x28 || 0x8 || 0x0 || <br /> |-<br /> | 0x30 || 0x10 || 0x0 || <br /> |-<br /> |}<br /> <br /> Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case.<br /> <br /> Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs<br /> <br /> ==='info1'===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || 0x0 || <br /> |-<br /> | 0x04 || 0x4 || 0x3 || <br /> |-<br /> | 0x08 || 0x8 || 0x40 || Offset/size?<br /> |-<br /> | 0x10 || 0x4 || 0x0 || <br /> |-<br /> | 0x14 || 0x4 || 0x0 || <br /> |-<br /> | 0x18 || 0x8 || 0x1000 || 'Content' Data Size?<br /> |-<br /> | 0x20 || 0x8 || 0x1 || <br /> |-<br /> | 0x28 || 0x8 || 0x1 || <br /> |-<br /> | 0x30 || 0x10 || 0x0 || <br /> |-<br /> |}<br /> ==='content' overview===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> |-<br /> | 0x0 || 0x1000 || - || 'content'<br /> |-<br /> |}<br /> <br /> == Known Retail syscon update packages ==<br /> These are in full Retail/CEX and Debug/DEX firmwares:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! [[Motherboard Revisions|Board]] !! [[Syscon Hardware]] !! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.75 !! SoftID or Syscon Revision !! Notes<br /> |-{{cellcolors|lightgrey}}<br /> ! rowspan=3 | [[COK-00x#COK-001|COK-001]] !! rowspan=3 | [[CXR713120-201GB]]<br /> | SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000005.pkg<br /> |-{{cellcolors|lightgrey}}<br /> | SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000006.pkg<br /> |-<br /> | SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0B8E || <br /> |-{{cellcolors|lightgrey}}<br /> ! rowspan=2 | [[COK-00x#COK-002|COK-002]] || rowspan=2 | [[CXR713120-201GB]]&lt;br /&gt;[[CXR713120-202GB]]<br /> | SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0C16 || Superseded by SYS_CON_FIRMWARE_01010303.pkg<br /> |-<br /> | SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0C16 || <br /> |-<br /> ! [[SEM-00x|SEM-001]] || [[CXR713120-201GB]]&lt;br /&gt;[[CXR713120-202GB]]&lt;br /&gt;[[CXR713120-203GB]]<br /> | SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0D52 || <br /> |-<br /> ! [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]]<br /> | SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0DBF || <br /> |-<br /> ! [[DIA-00x#DIA-002|DIA-002]] / [[DEB-00x#DEB-001|DEB-001]] || [[CXR714120-301GB]]&lt;br /&gt;[[CXR714120-302GB]]<br /> | SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0E69 || <br /> |-<br /> ! ??? || ???<br /> | SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0F29 || rowspan=2 | CXR714120-X0XGB / SW-30x Prototype<br /> |-<br /> ! ??? || ???<br /> | SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || 0F38<br /> |-<br /> ! [[VER-00x|VER-001]] || [[SW-30x]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 065D || <br /> |-<br /> ! [[DYN-00x|DYN-001]] || rowspan=4 | [[SW2-30x]]<br /> | SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || 0832 || rowspan=2 | ps3 2k series<br /> |-<br /> ! [[SUR-00x|SUR-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08A0<br /> |-<br /> ! [[JTP-00x|JTP-001]]&lt;br /&gt;[[JSD-00x|JSD-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08C2 || ps3 2k5 series<br /> |-<br /> ! [[KTE-00x|KTE-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0918 || ps3 3k series<br /> |-<br /> ! [[MSX-00x|MSX-001]]&lt;br /&gt;[[MPX-00x|MPX-001]] || [[SW3-30x]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 098F || ps3 4k series<br /> |}<br /> <br /> This means from syscon perspective notible firmware changes where made at 1.30, 1.81, 3.00, 3.40 and 3.41 that affected retail and debug PS3 models<br /> *Firmware 1.30 (December 6, 2006) added Backup/Restore<br /> *Firmware 1.81 (June 15, 2007) ?<br /> *Firmware 3.00 (September 1, 2009) resulted in Class action suit for BluRay reading problems<br /> *Firmware 3.40 (June 29, 2010) ?<br /> *Firmware 3.41 (July 26, 2010) ?<br /> <br /> == NonRetail syscon ==<br /> Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the [[DECR-1000A]] TOOL/DECR).<br /> <br /> Tool/DECR don't have patches, they flash entire firmwares.&lt;br /&gt;<br /> <br /> Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)&lt;br&gt;<br /> it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see [[Talk:Communication_Processor]] for more info on how to downgrade)&lt;br&gt;<br /> <br /> DECR samples: [https://mega.co.nz/#!g50S1LRD!g8n1C191ax61YibnLEHJCQ63fT_ye1hA4Dhhrfulfs0] [https://mega.co.nz/#!jgVVCYZC!HaUXkeKFJNbzxAVkbO-Aj5LC2-yriY7rmUWKljlEQ40 mirror]:<br /> v0.6.1c8_TMU510_u.bin | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE<br /> v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91<br /> v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D<br /> v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5<br /> v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49<br /> v0.8.4c8_TMU510_u.bin | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E<br /> v0.9.9c1_TMU510_u.bin | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464<br /> v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9<br /> v1.0.1c1_TMU510_u.bin | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF<br /> v1.0.3c1_TMU510_u.bin | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E<br /> v1.0.4c1_TMU510_u.bin | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513<br /> v1.0.5c1_TMU510_u.bin | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE<br /> <br /> === dev/hda ===<br /> dev_hda.image from [[DECR-1000A]] CP: [http://mega/content/secure.html#!shd2VBwI!aElpZXIMqxdAP0hw775sNhmkwJewVXafQvdFUGQ5Lgo dev_hda.image] [https://mega.co.nz/#!y8kWmSqR!4PPNen3bukLWt-EZm_zENT9G8Ey-Fi0YcaLHNey41m0 dev_hda.image.7z]<br /> <br /> ==== Partitions ====<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! device file !! size !! type<br /> |-<br /> | /dev/loop0p1 || 51 MB (50577408 bytes) || 0x89<br /> |-<br /> | /dev/loop0p2 || 8,7 MB (8650752 bytes) || Linux<br /> |-<br /> | /dev/loop0p3 || 32 MB (31981568 bytes) || Linux<br /> |-<br /> | /dev/loop0p4 || 35 MB (35127296 bytes) || Extended<br /> |-<br /> | /dev/loop0 || 4,9 MB (4883968 bytes) || Unassigned<br /> |-<br /> |}<br /> <br /> === Deviating from Retail ===<br /> Please note that without info about the SKU the listing of ID's is pretty useless<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.11 !! SoftID !! Notes<br /> |-<br /> | ? || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B67 || Debug/DEX<br /> |-<br /> |}<br /> <br /> == Usage ==<br /> <br /> The firmware PUP's contains a collection of patches for all the different hardware revisions of syscon's chips used in different motherboard models.<br /> <br /> The ps3swu.self (system updater) decides which applicable [[Syscon Hardware]] is present and installs the needed package update(s) accordingly (via updater manager ss service).<br /> <br /> Which syscon version and which patches are installed can be seen in [[More_System_Information]]<br /> <br /> == Decryption ==<br /> Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB).<br /> <br /> === Patch/Firmware Body Decryption/Hashing ===<br /> <br /> The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch<br /> <br /> We know that:<br /> <br /> * Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc)<br /> * Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables)<br /> * Authenticated regions uses a form of what seems to be some ECB with tweak xoring (as graf once said about XTS)<br /> * XTS was introduced in 2007 and SysCon from ps3 exists for far more time than that (2003)<br /> * XEX is a close relative of XTS that was introduced in 1984<br /> * PS4 uses XTS for Authenticated Regions or SNVS (with sector size of 0x20 being used. is this even considered safe?)<br /> * 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50)<br /> * here are the DPA bytes for each of the controlable sections:<br /> * 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001)<br /> * 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001)<br /> * 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content)<br /> * 7B FC 27 CD D5 9A 05 09 3A DF E4 75 BF FD 03 1A (section 3/header AA from DEB-001 patch content)<br /> * 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content)<br /> * 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward)<br /> * 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse)<br /> * 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward)<br /> * 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER)<br /> * some bytes are considered &quot;weak&quot; bytes and should be bruteforced in the eventuality these keys fail<br /> * another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc<br /> * since key expansions take 10 &quot;hills&quot; in the analysis, it should be safe to assume that AES-128 is used(because it uses 10 rounds).<br /> * 6554cff202c3bfdd9740901070b705bf : correct md5 for patch content we are trying keys on (DIA-001)<br /> * 4875ad06a1499cc516a0d4d92e595794 : correct md5 for patch content we are trying keys on (DEB-001/DIA-002)<br /> * trying a different header/body patch content from another similar board will result into failure of decrypting body, which means that the header is checked for authenticity and that the header hash is NOT in the header<br /> * altering the patch header doesn't cause the patch header dpa bytes to change (a test was done with 4 bytes and the result was 16 32 47 79, which matches the other patch dpa recovered bytes)<br /> * there are in fact not 4 but 5 aes sections. the last one seems to be body related, as changing the body even one bit makes the last aes section disappear.<br /> * section 2 is divided into two sections, corresponding to TopHalf and BottomHalf of patch area.<br /> * TopHalf uses forward ttables/sbox. BottomHalf uses inverse ttables/sbox<br /> * TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10)<br /> * BottomHalf is the rest of the body itself.<br /> <br /> == Header ==<br /> The header format is partially unknown at this stage.<br /> All the Firmwares patches are written in little endian.<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Offset !! Length !! Notes !! Related DECR Error !! Notes<br /> |-<br /> | 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) ||<br /> |-<br /> | 0x4 || 0x10 || Header CMAC1 || FFFFFED1 (Header Check Error) || CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes and where Header CMAC2 is zeroed Concatenated with Encrypted Body <br /> |-<br /> | 0x14 || 0x10 || Header CMAC2 || FFFFFED1 (Header Check Error) || CMAC of Header (where this cmac has been zeroed)<br /> |-<br /> | 0x24 || 0x4 || Padding || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x28 || 0x4 || Total size || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x2c || 0x4 || Size of binary || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x30 || 0x10 || IV for AES-128 CBC || FFFFFED1 (Header Check Error) || <br /> |-<br /> | 0x40 || 0xfc0 || Encrypted binary || FFFFFED0 (Data Check Error) / FFFFFECF (Data Size Check Error) ||<br /> |-<br /> |}<br /> <br /> * Note: For the weird bogus update ONLY: FFFFFF37 (Alignment Error?) (Trying any data size between 0x41 and 0x4C bytes)<br /> * Note2: v0.6.14c4 is the bogus update (only update with a weird header)<br /> * Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0<br /> <br /> === Samples ===<br /> &lt;pre&gt;<br /> 00000000 1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D .-p.«^³™h þ=á€j.<br /> 00000010 B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA ¸ý7ÏÍE…«Q÷.ãê2¥ê<br /> 00000020 67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00 gEùH........À...<br /> 00000030 8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D ‹..ù›¢.:u‰ñB.YÚ.<br /> 00000040 21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63 !|¢ÃZäx...K÷¢sœc<br /> 00000050 5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA ].]I.Ço,.3þ.Ól¡Ê<br /> 00000060 BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80 º.+þ.3q×Åæ\ÿ¿wl€<br /> 00000070 F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48 ò¾.»&lt;RRÜ©hå$.OóH<br /> &lt;/pre&gt;<br /> <br /> -From v1.0.4c2_TMU510_u-<br /> &lt;pre&gt;<br /> 00000000 73 79 73 31 73 47 59 5D FB 85 3B 7B 4A 28 10 5D sys1sGY]û…;{J( ]<br /> 00000010 46 EE 8C 01 3C B4 F1 82 1E 18 4F B7 4A 56 FC C7 FîŒ &lt;´ñ‚ O·JVüÇ<br /> 00000020 FF 83 0B E0 00 00 00 00 40 00 06 00 00 00 06 00 ÿƒ à @ <br /> 00000030 69 B6 02 69 3A 97 8B 1C 4E 18 D4 E0 63 7D CA 94 i¶ i:—‹ N Ôàc}Ê”<br /> 00000040 4B A0 79 34 79 41 BD 09 BB 68 D4 0A A0 B7 05 78 K y4yA½ »hÔ  · x<br /> 00000050 D9 8F 8F 28 6C 9A 1B 61 CF A1 E7 49 7D CA C4 A3 Ù (lš aÏ¡çI}ÊÄ£<br /> 00000060 A4 4D 4B E0 AE 48 86 03 B1 43 F2 47 C0 C4 1D 4F ¤MKà®H† ±CòGÀÄ O<br /> 00000070 FA E8 43 A7 1E 6E 79 8C E5 FF 04 20 E9 44 09 B5 úèC§ nyŒåÿ éD µ<br /> &lt;/pre&gt;<br /> <br /> === Observations ===<br /> * The first 4 bytes (0x1B2D700F) appear static in each package.<br /> * The next 0x20 bytes appear to change with each package<br /> * The following 12 bytes (0x0000000000100000C00F0000) also appear static, but it's the firmware size and fw size - header size; infact if correctly converted to little endian 00000000 00001000 00000fc0, where 00000000 is Unknown, 00001000 is 4096 in dec (file size) and 00000fc0 is 4032 in dec (update size).<br /> * On the DECH fw, the update works in the same way: 000000004000060000000600 converted will be: 00000000 00060040 00060000, where, 00000000 is probably padding, file size 00060040, 00060000 update size<br /> * the first 0x40 bytes probably are IV + HASH + update infos. probably the algorithm used is AES.<br /> * algorithm used is aes 128 cbc on the body (iv is at + 0x30)<br /> <br /> == Access to Syscon from Linux ==<br /> Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON<br /> <br /> == List of Soft IDs in Decimal Form ==<br /> &lt;pre&gt;<br /> 2958<br /> 3094<br /> 3410<br /> 3519<br /> 3689<br /> 3881<br /> 3896<br /> &lt;/pre&gt;<br /> <br /> == Placeholder for bga patch key generation ==<br /> <br /> &lt;pre&gt;<br /> 34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 4:....__SCEISYS1<br /> &lt;/pre&gt;<br /> <br /> * replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id<br /> <br /> * replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id<br /> <br /> = PTCH Firmware TOC =<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> !Offset!!Size!!Notes!!Number<br /> |-<br /> | 0x00 || 0x2 || Major Version || 1<br /> |-<br /> | 0x02 || 0x2 || Minor Version || 1<br /> |- <br /> | 0x04 || 0x2 || Major Revision || 1<br /> |-<br /> | 0x06 || 0x2 || Minor Revision || 1<br /> |-<br /> | 0x08 || 0x10 || PTCH Addresses || 4*4<br /> |-<br /> | 0x18 || 0x4 || PTCH #1 Instruction / Data || 1 <br /> |-<br /> | 0x1C || 0x4 || PTCH #2 Instruction / Data || 1<br /> |-<br /> | 0x20 || 0x4 || PTCH #3 Instruction / Data || 1<br /> |-<br /> | 0x24 || 0x4 || PTCH #4 Instruction / Data || 1<br /> |-<br /> | 0x28 || 0x10 || Additional PTCH Instruction Addresses || 4*4<br /> |-<br /> | 0x38 || 0x388 || Additional PTCH Instructions || 1<br /> |-<br /> | 0x3C0 || 0xC00 || HDMI Related PTCH Instructions || 1<br /> |-<br /> |}<br /> <br /> = External commands =<br /> <br /> &lt;pre&gt;<br /> Address Command Subcommand Permission<br /> 0x333C5 BOOT MODE 0x000080D6<br /> 0x33441 BOOT CONT 0x000080D5<br /> 0x34EA9 SHUTDOWN 0x0000C0D5<br /> 0x334BD HALT 0x0000C0D5<br /> 0x334F1 BOOTENABLE 0x0000809A<br /> 0x33F5F AUTH1 0x0000C0EF<br /> 0x33FF5 AUTH2 0x0000C0EF<br /> 0x340EB AUTHVER SET 0x0000C0DF<br /> 0x34091 AUTHVER GET 0x0000C0FF<br /> 0x3352F EEP INIT 0x000080DA<br /> 0x336BD EEP SET 0x0000C0DF<br /> 0x337DF EEP GET 0x0000C0DF<br /> 0x33A71 PDAREA SET 0x0000C0DF<br /> 0x338F7 PDAREA GET 0x0000C0DF<br /> 0x33B85 CSAREA SET 0x0000C0DF<br /> 0x33B19 CSAREA GET 0x0000C0DF<br /> 0x33C29 VID GET 0x0000C0D5<br /> 0x33C97 CID GET 0x0000C0D5<br /> 0x33CDD ECID GET 0x0000C0D5<br /> 0x33D1D REV SB 0x0000C0D5<br /> 0x33D4D SPU INFO 0x0000C0D5<br /> 0x33DA1 KSV 0x0000C0D5<br /> 0x34157 FAN SETPOLICY 0x0000C0D7<br /> 0x341E5 FAN GETPOLICY 0x0000C0D7<br /> 0x3424F FAN START 0x0000C0D7<br /> 0x3424F FAN STOP 0x0000C0D7<br /> 0x34425 FAN SETDUTY 0x0000C0D7<br /> 0x34493 FAN GETDUTY 0x0000C0D7<br /> 0x344F5 R8 0x0000C0DF<br /> 0x3459F W8 0x0000C0DF<br /> 0x3463F R16 0x0000C0DF<br /> 0x346E7 W16 0x0000C0DF<br /> 0x34789 R32 0x0000C0DF<br /> 0x3492F W32 0x0000C0DF<br /> 0x349CF RBE 0x0000C0D5<br /> 0x34A77 WBE 0x0000C0D5<br /> 0x34B2F PORTSTAT 0x0000C0DF<br /> 0x33D7F VER 0x0000C0FF<br /> 0x34CAD BUZ 0x00008096<br /> 0x34CE1 BTNEMU SYNC 0x0000C0D7<br /> 0x34CE1 BTNEMU ASYNC 0x0000C0D7<br /> 0x34EA9 SERVFAN 0x0000C0D7<br /> 0x34D6F ERRLOG START 0x0000C0DF<br /> 0x34D93 ERRLOG STOP 0x0000C0DF<br /> 0x34DB7 ERRLOG GET 0x0000C0FF<br /> 0x34E1D ERRLOG CLEAR 0x0000C0DF<br /> 0x34E41 NONFATALERR 0x0000C0DF<br /> &lt;/pre&gt;<br /> <br /> = Internal commands =<br /> &lt;pre&gt;<br /> Command Address Permission <br /> becount 0xC0E7 0xDD0C0000 <br /> bestat 0xCDB7 0xFD0F0000 <br /> bringup 0xCF3B 0xFD0F0000 <br /> bsn 0xD231 0xF00F0000 <br /> bstatus 0x20DC5 0xDD0C0000 <br /> btnemua 0xCFD1 0xDD0F0000 <br /> btnemus 0xCFD1 0xDD0F0000 <br /> clear_err 0x21227 0xDD0C0000 <br /> clearerrlog 0xB0D9 0xDD0C0000 <br /> csum 0xD0B5 0xFF0F0000 <br /> devpm 0xC637 0xDD0C0000 <br /> disp_err 0x211DD 0xDD0C0000 <br /> duty 0x99E5 0xDD0C0000 <br /> eepcsum 0xA2B1 0xDD0C0000 <br /> ejectsw 0xCFC1 0xFD0F0000 <br /> errlog 0xAFF9 0xFF0C0000 <br /> fancon 0xC865 0x0D000000 <br /> fanconautotype 0xB839 0xDD0C0000 <br /> fanconmode 0xB7A5 0xDD0C0000 <br /> fanconpolicy 0xB361 0xDD0C0000 <br /> faninictrl 0xCB27 0x0D000000 <br /> fanpol 0xC09B 0xDD0C0000 <br /> fanservo 0xB693 0xDD0C0000 <br /> fantbl 0xB84B 0xDD0C0000 <br /> firmud 0xD04F 0xFDFF0000 <br /> geterrlog 0xB05D 0xDD0C0000 <br /> getrtc 0xA071 0xDD0C0000 <br /> hdmi 0x25241 0xDD0C0000 <br /> hdmiid 0x25025 0xDC0F0000 <br /> hdmiid2 0x25089 0xDC0F0000 <br /> hversion 0x20D8B 0xDD0C0000 <br /> hyst 0xA751 0xDD0C0000 <br /> lasterrlog 0xB00B 0xDD0C0000 <br /> ltstest 0xC1A5 0xDD0C0000<br /> LS 0x20D77 0xDD0C0000 <br /> nonfatalerror 0xDCAD 0xDD0C0000<br /> patchcsum 0xD423 0xDD0C0000 <br /> patchvereep 0xD3DD 0xDD0C0000 <br /> patchverram 0xD391 0xDD0C0000 <br /> poll 0x20C3F 0xDD0C0000 <br /> portscan 0xD439 0xDD0C0000 <br /> powerstate 0xC45B 0xDD0C0000 <br /> powersw 0xCFA1 0xFD0F0000 <br /> powupcause 0xAE31 0xDD0C0000 <br /> printpatch 0xD37B 0xDC0C0000 <br /> r 0x8D59 0xDD0C0000 <br /> r16 0x8F97 0xDD0C0000 <br /> r32 0x9255 0xDD0C0000 <br /> r64 0x9427 0xDD0C0000 <br /> r64d 0x9559 0xDD0C0000 <br /> rbe 0x97C5 0xDD0C0000 <br /> recv 0x20C91 0xDD0C0000 <br /> resetsw 0xCFB1 0xFC0F0000 <br /> restartlogerrtoeep 0xB111 0xDD0C0000 <br /> revision 0xD20D 0xFFFF0000 <br /> rrsxc 0xCA65 0xDD0C0000 <br /> scagv2 0xDC7B 0xFF000000 <br /> scasv2 0xDC33 0xDD000000 <br /> scclose 0xDC1B 0xFF000000 <br /> scopen 0xDB4D 0xFF000000 <br /> send 0x20CCB 0xDD0C0000 <br /> shutdown 0xCF6D 0xFD0F0000 <br /> startlogerrtsk 0xB0F5 0xDD0C0000 <br /> stoplogerrtoeep 0xB103 0xDD0C0000 <br /> stoplogerrtsk 0xB0E7 0xDD0C0000 <br /> syspowdown 0xAE79 0xDD0C0000 <br /> task 0x14919 0xDD0C0000 <br /> thalttest 0xD23F 0x000F0000 <br /> thermfatalmode 0xC0A5 0xDD0C0000 <br /> therrclr 0xCD85 0xDD0C0000 <br /> thrm 0xB5C7 0xDD0C0000 <br /> tmp 0xA2C7 0xDD0C0000 <br /> trace 0xB11F 0xDD0C0000 <br /> trp 0xA38D 0xDD0C0000 <br /> tsensor 0x9EB9 0xDD0C0000 <br /> tshutdown 0xAA97 0xDD0C0000 <br /> tshutdowntime 0xBFC1 0xDD0C0000 <br /> tzone 0xADF1 0xDD0C0000 <br /> version 0xD091 0xFFFF0000 <br /> w 0x8CAD 0xDD0C0000 <br /> w16 0x8EED 0xDD0C0000 <br /> w32 0x90AF 0xDD0C0000 <br /> w64 0x936D 0xDD0C0000 <br /> wbe 0x9731 0xDD0C0000 <br /> wrsxc 0xC9CB 0xDD0C0000<br /> &lt;/pre&gt;<br /> {{Custom Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Syscon_Firmware&diff=54930 Syscon Firmware 2019-12-20T15:44:15Z <p>93.108.187.41: /* External commands */</p> <hr /> <div>Syscon Firmware is the firmware stored on the System Controller EEPROM (see [[Syscon Hardware]]). Updates are stored in update packages within the Update_files.tar of a [[Playstation Update Package (PUP)]]. Syscon Packages appear to always be 5KB (5376 bytes) in size.<br /> <br /> <br /> = Syscon update packages =<br /> d/l: [http://www.multiupload.com/JHBCOCGNUR syscon_fw1.00-4.00.rar (51.74 KB)]<br /> <br /> == Package structure ==<br /> Sys_con_firmware Packages can be unpacked with unpkg<br /> <br /> === Overview ===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || ASCI:&quot;SCE&quot; || SCE magic header<br /> |-<br /> | 0x04 || 0x4 || 0x2 || Flags<br /> |-<br /> | 0x08 || 0x4 || 0x3 || Type (0x3 = PKG)<br /> |-<br /> | 0x0C || 0x4 || 0x0 || Blank/Unknown<br /> |-<br /> | 0x10 || 0x4 || 0x0 || Blank/Unknown<br /> |-<br /> | 0x10 || 0x8 || 0x280 || Start Data Offset ('hdr_len')<br /> |-<br /> | 0x18 || 0x8 || 0x1080 || Data Size ('dec_size')<br /> |-<br /> | 0x20 || 0x260 || - || Header<br /> |-<br /> | 0x280 || 0x40 || - || 'info0' section (see below)<br /> |-<br /> | 0x2C0 || 0x40 || - || 'info1' section (see below)<br /> |-<br /> | 0x300 || 0x1000 || - || 'content'<br /> |-<br /> |}<br /> ==='info0'===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || 0x3 || <br /> |-<br /> | 0x04 || 0x4 || 0x8 || <br /> |-<br /> | 0x08 || 0x8 || - || SC firmware revision (the high word of it is the SC type)<br /> |-<br /> | 0x0C || 0x4 || 0x0B8E(1.30-4.84)&lt;br /&gt;0x0C16(1.81-4.84)&lt;br /&gt;0x0D52(3.40-4.84)&lt;br /&gt;0x0DBF(3.40-4.84)&lt;br /&gt;0x0E69(3.40-4.84)&lt;br /&gt;0x0F29(3.40-4.84)&lt;br /&gt;0x0F38(3.41-4.84)&lt;br /&gt;0x065D&lt;br /&gt;0x0832(3.00-4.84)&lt;br /&gt;0x08A0&lt;br /&gt;0x08C2&lt;br /&gt;0x0918 || 'SoftID'<br /> |-<br /> | 0x10 || 0x8 || 0x0001000000000004&lt;br /&gt;0x0001000000000005&lt;br /&gt;0x0001000000000006&lt;br /&gt;0x0001000100030002&lt;br /&gt;0x0001000100030003&lt;br /&gt;0x0001000200030002&lt;br /&gt;0x0001000300030002&lt;br /&gt;0x0001000400040002&lt;br /&gt;0x0001000500000002&lt;br /&gt;0x0001000500010001&lt;br /&gt;0x00010002083E0832&lt;br /&gt; || 'PatchID'<br /> |-<br /> | 0x18 || 0x8 || 0x1000 || 'Content' Data Size<br /> |-<br /> | 0x20 || 0x8 || 0x1000 || 'Content' Compressed Data Size<br /> |-<br /> | 0x28 || 0x8 || 0x0 || <br /> |-<br /> | 0x30 || 0x10 || 0x0 || <br /> |-<br /> |}<br /> <br /> Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case.<br /> <br /> Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs<br /> <br /> ==='info1'===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || 0x0 || <br /> |-<br /> | 0x04 || 0x4 || 0x3 || <br /> |-<br /> | 0x08 || 0x8 || 0x40 || Offset/size?<br /> |-<br /> | 0x10 || 0x4 || 0x0 || <br /> |-<br /> | 0x14 || 0x4 || 0x0 || <br /> |-<br /> | 0x18 || 0x8 || 0x1000 || 'Content' Data Size?<br /> |-<br /> | 0x20 || 0x8 || 0x1 || <br /> |-<br /> | 0x28 || 0x8 || 0x1 || <br /> |-<br /> | 0x30 || 0x10 || 0x0 || <br /> |-<br /> |}<br /> ==='content' overview===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> |-<br /> | 0x0 || 0x1000 || - || 'content'<br /> |-<br /> |}<br /> <br /> == Known Retail syscon update packages ==<br /> These are in full Retail/CEX and Debug/DEX firmwares:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! [[Motherboard Revisions|Board]] !! [[Syscon Hardware]] !! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.75 !! SoftID or Syscon Revision !! Notes<br /> |-{{cellcolors|lightgrey}}<br /> ! rowspan=3 | [[COK-00x#COK-001|COK-001]] !! rowspan=3 | [[CXR713120-201GB]]<br /> | SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000005.pkg<br /> |-{{cellcolors|lightgrey}}<br /> | SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000006.pkg<br /> |-<br /> | SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0B8E || <br /> |-{{cellcolors|lightgrey}}<br /> ! rowspan=2 | [[COK-00x#COK-002|COK-002]] || rowspan=2 | [[CXR713120-201GB]]&lt;br /&gt;[[CXR713120-202GB]]<br /> | SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0C16 || Superseded by SYS_CON_FIRMWARE_01010303.pkg<br /> |-<br /> | SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0C16 || <br /> |-<br /> ! [[SEM-00x|SEM-001]] || [[CXR713120-201GB]]&lt;br /&gt;[[CXR713120-202GB]]&lt;br /&gt;[[CXR713120-203GB]]<br /> | SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0D52 || <br /> |-<br /> ! [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]]<br /> | SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0DBF || <br /> |-<br /> ! [[DIA-00x#DIA-002|DIA-002]] / [[DEB-00x#DEB-001|DEB-001]] || [[CXR714120-301GB]]&lt;br /&gt;[[CXR714120-302GB]]<br /> | SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0E69 || <br /> |-<br /> ! ??? || ???<br /> | SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0F29 || rowspan=2 | CXR714120-X0XGB / SW-30x Prototype<br /> |-<br /> ! ??? || ???<br /> | SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || 0F38<br /> |-<br /> ! [[VER-00x|VER-001]] || [[SW-30x]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 065D || <br /> |-<br /> ! [[DYN-00x|DYN-001]] || rowspan=4 | [[SW2-30x]]<br /> | SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || 0832 || rowspan=2 | ps3 2k series<br /> |-<br /> ! [[SUR-00x|SUR-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08A0<br /> |-<br /> ! [[JTP-00x|JTP-001]]&lt;br /&gt;[[JSD-00x|JSD-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08C2 || ps3 2k5 series<br /> |-<br /> ! [[KTE-00x|KTE-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0918 || ps3 3k series<br /> |-<br /> ! [[MSX-00x|MSX-001]]&lt;br /&gt;[[MPX-00x|MPX-001]] || [[SW3-30x]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 098F || ps3 4k series<br /> |}<br /> <br /> This means from syscon perspective notible firmware changes where made at 1.30, 1.81, 3.00, 3.40 and 3.41 that affected retail and debug PS3 models<br /> *Firmware 1.30 (December 6, 2006) added Backup/Restore<br /> *Firmware 1.81 (June 15, 2007) ?<br /> *Firmware 3.00 (September 1, 2009) resulted in Class action suit for BluRay reading problems<br /> *Firmware 3.40 (June 29, 2010) ?<br /> *Firmware 3.41 (July 26, 2010) ?<br /> <br /> == NonRetail syscon ==<br /> Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the [[DECR-1000A]] TOOL/DECR).<br /> <br /> Tool/DECR don't have patches, they flash entire firmwares.&lt;br /&gt;<br /> <br /> Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)&lt;br&gt;<br /> it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see [[Talk:Communication_Processor]] for more info on how to downgrade)&lt;br&gt;<br /> <br /> DECR samples: [https://mega.co.nz/#!g50S1LRD!g8n1C191ax61YibnLEHJCQ63fT_ye1hA4Dhhrfulfs0] [https://mega.co.nz/#!jgVVCYZC!HaUXkeKFJNbzxAVkbO-Aj5LC2-yriY7rmUWKljlEQ40 mirror]:<br /> v0.6.1c8_TMU510_u.bin | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE<br /> v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91<br /> v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D<br /> v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5<br /> v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49<br /> v0.8.4c8_TMU510_u.bin | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E<br /> v0.9.9c1_TMU510_u.bin | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464<br /> v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9<br /> v1.0.1c1_TMU510_u.bin | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF<br /> v1.0.3c1_TMU510_u.bin | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E<br /> v1.0.4c1_TMU510_u.bin | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513<br /> v1.0.5c1_TMU510_u.bin | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE<br /> <br /> === dev/hda ===<br /> dev_hda.image from [[DECR-1000A]] CP: [http://mega/content/secure.html#!shd2VBwI!aElpZXIMqxdAP0hw775sNhmkwJewVXafQvdFUGQ5Lgo dev_hda.image] [https://mega.co.nz/#!y8kWmSqR!4PPNen3bukLWt-EZm_zENT9G8Ey-Fi0YcaLHNey41m0 dev_hda.image.7z]<br /> <br /> ==== Partitions ====<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! device file !! size !! type<br /> |-<br /> | /dev/loop0p1 || 51 MB (50577408 bytes) || 0x89<br /> |-<br /> | /dev/loop0p2 || 8,7 MB (8650752 bytes) || Linux<br /> |-<br /> | /dev/loop0p3 || 32 MB (31981568 bytes) || Linux<br /> |-<br /> | /dev/loop0p4 || 35 MB (35127296 bytes) || Extended<br /> |-<br /> | /dev/loop0 || 4,9 MB (4883968 bytes) || Unassigned<br /> |-<br /> |}<br /> <br /> === Deviating from Retail ===<br /> Please note that without info about the SKU the listing of ID's is pretty useless<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.11 !! SoftID !! Notes<br /> |-<br /> | ? || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B67 || Debug/DEX<br /> |-<br /> |}<br /> <br /> == Usage ==<br /> <br /> The firmware PUP's contains a collection of patches for all the different hardware revisions of syscon's chips used in different motherboard models.<br /> <br /> The ps3swu.self (system updater) decides which applicable [[Syscon Hardware]] is present and installs the needed package update(s) accordingly (via updater manager ss service).<br /> <br /> Which syscon version and which patches are installed can be seen in [[More_System_Information]]<br /> <br /> == Decryption ==<br /> Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB).<br /> <br /> === Patch/Firmware Body Decryption/Hashing ===<br /> <br /> The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch<br /> <br /> We know that:<br /> <br /> * Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc)<br /> * Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables)<br /> * Authenticated regions uses a form of what seems to be some ECB with tweak xoring (as graf once said about XTS)<br /> * XTS was introduced in 2007 and SysCon from ps3 exists for far more time than that (2003)<br /> * XEX is a close relative of XTS that was introduced in 1984<br /> * PS4 uses XTS for Authenticated Regions or SNVS (with sector size of 0x20 being used. is this even considered safe?)<br /> * 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50)<br /> * here are the DPA bytes for each of the controlable sections:<br /> * 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001)<br /> * 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001)<br /> * 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content)<br /> * 7B FC 27 CD D5 9A 05 09 3A DF E4 75 BF FD 03 1A (section 3/header AA from DEB-001 patch content)<br /> * 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content)<br /> * 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward)<br /> * 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse)<br /> * 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward)<br /> * 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER)<br /> * some bytes are considered &quot;weak&quot; bytes and should be bruteforced in the eventuality these keys fail<br /> * another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc<br /> * since key expansions take 10 &quot;hills&quot; in the analysis, it should be safe to assume that AES-128 is used(because it uses 10 rounds).<br /> * 6554cff202c3bfdd9740901070b705bf : correct md5 for patch content we are trying keys on (DIA-001)<br /> * 4875ad06a1499cc516a0d4d92e595794 : correct md5 for patch content we are trying keys on (DEB-001/DIA-002)<br /> * trying a different header/body patch content from another similar board will result into failure of decrypting body, which means that the header is checked for authenticity and that the header hash is NOT in the header<br /> * altering the patch header doesn't cause the patch header dpa bytes to change (a test was done with 4 bytes and the result was 16 32 47 79, which matches the other patch dpa recovered bytes)<br /> * there are in fact not 4 but 5 aes sections. the last one seems to be body related, as changing the body even one bit makes the last aes section disappear.<br /> * section 2 is divided into two sections, corresponding to TopHalf and BottomHalf of patch area.<br /> * TopHalf uses forward ttables/sbox. BottomHalf uses inverse ttables/sbox<br /> * TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10)<br /> * BottomHalf is the rest of the body itself.<br /> <br /> == Header ==<br /> The header format is partially unknown at this stage.<br /> All the Firmwares patches are written in little endian.<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Offset !! Length !! Notes !! Related DECR Error !! Notes<br /> |-<br /> | 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) ||<br /> |-<br /> | 0x4 || 0x10 || Header CMAC1 || FFFFFED1 (Header Check Error) || CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes and where Header CMAC2 is zeroed Concatenated with Encrypted Body <br /> |-<br /> | 0x14 || 0x10 || Header CMAC2 || FFFFFED1 (Header Check Error) || CMAC of Header (where this cmac has been zeroed)<br /> |-<br /> | 0x24 || 0x4 || Padding || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x28 || 0x4 || Total size || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x2c || 0x4 || Size of binary || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x30 || 0x10 || IV for AES-128 CBC || FFFFFED1 (Header Check Error) || <br /> |-<br /> | 0x40 || 0xfc0 || Encrypted binary || FFFFFED0 (Data Check Error) / FFFFFECF (Data Size Check Error) ||<br /> |-<br /> |}<br /> <br /> * Note: For the weird bogus update ONLY: FFFFFF37 (Alignment Error?) (Trying any data size between 0x41 and 0x4C bytes)<br /> * Note2: v0.6.14c4 is the bogus update (only update with a weird header)<br /> * Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0<br /> <br /> === Samples ===<br /> &lt;pre&gt;<br /> 00000000 1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D .-p.«^³™h þ=á€j.<br /> 00000010 B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA ¸ý7ÏÍE…«Q÷.ãê2¥ê<br /> 00000020 67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00 gEùH........À...<br /> 00000030 8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D ‹..ù›¢.:u‰ñB.YÚ.<br /> 00000040 21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63 !|¢ÃZäx...K÷¢sœc<br /> 00000050 5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA ].]I.Ço,.3þ.Ól¡Ê<br /> 00000060 BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80 º.+þ.3q×Åæ\ÿ¿wl€<br /> 00000070 F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48 ò¾.»&lt;RRÜ©hå$.OóH<br /> &lt;/pre&gt;<br /> <br /> -From v1.0.4c2_TMU510_u-<br /> &lt;pre&gt;<br /> 00000000 73 79 73 31 73 47 59 5D FB 85 3B 7B 4A 28 10 5D sys1sGY]û…;{J( ]<br /> 00000010 46 EE 8C 01 3C B4 F1 82 1E 18 4F B7 4A 56 FC C7 FîŒ &lt;´ñ‚ O·JVüÇ<br /> 00000020 FF 83 0B E0 00 00 00 00 40 00 06 00 00 00 06 00 ÿƒ à @ <br /> 00000030 69 B6 02 69 3A 97 8B 1C 4E 18 D4 E0 63 7D CA 94 i¶ i:—‹ N Ôàc}Ê”<br /> 00000040 4B A0 79 34 79 41 BD 09 BB 68 D4 0A A0 B7 05 78 K y4yA½ »hÔ  · x<br /> 00000050 D9 8F 8F 28 6C 9A 1B 61 CF A1 E7 49 7D CA C4 A3 Ù (lš aÏ¡çI}ÊÄ£<br /> 00000060 A4 4D 4B E0 AE 48 86 03 B1 43 F2 47 C0 C4 1D 4F ¤MKà®H† ±CòGÀÄ O<br /> 00000070 FA E8 43 A7 1E 6E 79 8C E5 FF 04 20 E9 44 09 B5 úèC§ nyŒåÿ éD µ<br /> &lt;/pre&gt;<br /> <br /> === Observations ===<br /> * The first 4 bytes (0x1B2D700F) appear static in each package.<br /> * The next 0x20 bytes appear to change with each package<br /> * The following 12 bytes (0x0000000000100000C00F0000) also appear static, but it's the firmware size and fw size - header size; infact if correctly converted to little endian 00000000 00001000 00000fc0, where 00000000 is Unknown, 00001000 is 4096 in dec (file size) and 00000fc0 is 4032 in dec (update size).<br /> * On the DECH fw, the update works in the same way: 000000004000060000000600 converted will be: 00000000 00060040 00060000, where, 00000000 is probably padding, file size 00060040, 00060000 update size<br /> * the first 0x40 bytes probably are IV + HASH + update infos. probably the algorithm used is AES.<br /> * algorithm used is aes 128 cbc on the body (iv is at + 0x30)<br /> <br /> == Access to Syscon from Linux ==<br /> Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON<br /> <br /> == List of Soft IDs in Decimal Form ==<br /> &lt;pre&gt;<br /> 2958<br /> 3094<br /> 3410<br /> 3519<br /> 3689<br /> 3881<br /> 3896<br /> &lt;/pre&gt;<br /> <br /> == Placeholder for bga patch key generation ==<br /> <br /> &lt;pre&gt;<br /> 34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 4:....__SCEISYS1<br /> &lt;/pre&gt;<br /> <br /> * replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id<br /> <br /> * replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id<br /> <br /> = PTCH Firmware TOC =<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> !Offset!!Size!!Notes!!Number<br /> |-<br /> | 0x00 || 0x2 || Major Version || 1<br /> |-<br /> | 0x02 || 0x2 || Minor Version || 1<br /> |- <br /> | 0x04 || 0x2 || Major Revision || 1<br /> |-<br /> | 0x06 || 0x2 || Minor Revision || 1<br /> |-<br /> | 0x08 || 0x10 || PTCH Addresses || 4*4<br /> |-<br /> | 0x18 || 0x4 || PTCH #1 Instruction / Data || 1 <br /> |-<br /> | 0x1C || 0x4 || PTCH #2 Instruction / Data || 1<br /> |-<br /> | 0x20 || 0x4 || PTCH #3 Instruction / Data || 1<br /> |-<br /> | 0x24 || 0x4 || PTCH #4 Instruction / Data || 1<br /> |-<br /> | 0x28 || 0x10 || Additional PTCH Instruction Addresses || 4*4<br /> |-<br /> | 0x38 || 0x388 || Additional PTCH Instructions || 1<br /> |-<br /> | 0x3C0 || 0xC00 || HDMI Related PTCH Instructions || 1<br /> |-<br /> |}<br /> <br /> = External commands =<br /> <br /> &lt;pre&gt;<br /> Address Command Subcommand Permission<br /> 0x333C5 BOOT MODE 0x000080D6<br /> 0x33441 BOOT CONT 0x000080D5<br /> 0x34EA9 SHUTDOWN 0x0000C0D5<br /> 0x334BD HALT 0x0000C0D5<br /> 0x334F1 BOOTENABLE 0x0000809A<br /> 0x33F5F AUTH1 0x0000C0EF<br /> 0x33FF5 AUTH2 0x0000C0EF<br /> 0x340EB AUTHVER SET 0x0000C0DF<br /> 0x34091 AUTHVER GET 0x0000C0FF<br /> 0x3352F EEP INIT 0x000080DA<br /> 0x336BD EEP SET 0x0000C0DF<br /> 0x337DF EEP GET 0x0000C0DF<br /> 0x33A71 PDAREA SET 0x0000C0DF<br /> 0x338F7 PDAREA GET 0x0000C0DF<br /> 0x33B85 CSAREA SET 0x0000C0DF<br /> 0x33B19 CSAREA GET 0x0000C0DF<br /> 0x33C29 VID GET 0x0000C0D5<br /> 0x33C97 CID GET 0x0000C0D5<br /> 0x33CDD ECID GET 0x0000C0D5<br /> 0x33D1D REV SB 0x0000C0D5<br /> 0x33D4D SPU INFO 0x0000C0D5<br /> 0x33DA1 KSV 0x0000C0D5<br /> 0x34157 FAN SETPOLICY 0x0000C0D7<br /> 0x341E5 FAN GETPOLICY 0x0000C0D7<br /> 0x3424F FAN START 0x0000C0D7<br /> 0x3424F FAN STOP 0x0000C0D7<br /> 0x34425 FAN SETDUTY 0x0000C0D7<br /> 0x34493 FAN GETDUTY 0x0000C0D7<br /> 0x344F5 R8 0x0000C0DF<br /> 0x3459F W8 0x0000C0DF<br /> 0x3463F R16 0x0000C0DF<br /> 0x346E7 W16 0x0000C0DF<br /> 0x34789 R32 0x0000C0DF<br /> 0x3492F W32 0x0000C0DF<br /> 0x349CF RBE 0x0000C0D5<br /> 0x34A77 WBE 0x0000C0D5<br /> 0x34B2F PORTSTAT 0x0000C0DF<br /> 0x33D7F VER 0x0000C0FF<br /> 0x34CAD BUZ 0x00008096<br /> 0x34CE1 BTNEMU SYNC 0x0000C0D7<br /> 0x34CE1 BTNEMU ASYNC 0x0000C0D7<br /> 0x34EA9 SERVFAN 0x0000C0D7<br /> 0x34D6F ERRLOG START 0x0000C0DF<br /> 0x34D93 ERRLOG STOP 0x0000C0DF<br /> 0x34DB7 ERRLOG GET 0x0000C0FF<br /> 0x34E1D ERRLOG CLEAR 0x0000C0DF<br /> 0x34E41 NONFATALERR 0x0000C0DF<br /> &lt;/pre&gt;<br /> {{Custom Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Syscon_Firmware&diff=54929 Syscon Firmware 2019-12-20T15:43:49Z <p>93.108.187.41: /* PTCH Firmware TOC */</p> <hr /> <div>Syscon Firmware is the firmware stored on the System Controller EEPROM (see [[Syscon Hardware]]). Updates are stored in update packages within the Update_files.tar of a [[Playstation Update Package (PUP)]]. Syscon Packages appear to always be 5KB (5376 bytes) in size.<br /> <br /> <br /> = Syscon update packages =<br /> d/l: [http://www.multiupload.com/JHBCOCGNUR syscon_fw1.00-4.00.rar (51.74 KB)]<br /> <br /> == Package structure ==<br /> Sys_con_firmware Packages can be unpacked with unpkg<br /> <br /> === Overview ===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || ASCI:&quot;SCE&quot; || SCE magic header<br /> |-<br /> | 0x04 || 0x4 || 0x2 || Flags<br /> |-<br /> | 0x08 || 0x4 || 0x3 || Type (0x3 = PKG)<br /> |-<br /> | 0x0C || 0x4 || 0x0 || Blank/Unknown<br /> |-<br /> | 0x10 || 0x4 || 0x0 || Blank/Unknown<br /> |-<br /> | 0x10 || 0x8 || 0x280 || Start Data Offset ('hdr_len')<br /> |-<br /> | 0x18 || 0x8 || 0x1080 || Data Size ('dec_size')<br /> |-<br /> | 0x20 || 0x260 || - || Header<br /> |-<br /> | 0x280 || 0x40 || - || 'info0' section (see below)<br /> |-<br /> | 0x2C0 || 0x40 || - || 'info1' section (see below)<br /> |-<br /> | 0x300 || 0x1000 || - || 'content'<br /> |-<br /> |}<br /> ==='info0'===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || 0x3 || <br /> |-<br /> | 0x04 || 0x4 || 0x8 || <br /> |-<br /> | 0x08 || 0x8 || - || SC firmware revision (the high word of it is the SC type)<br /> |-<br /> | 0x0C || 0x4 || 0x0B8E(1.30-4.84)&lt;br /&gt;0x0C16(1.81-4.84)&lt;br /&gt;0x0D52(3.40-4.84)&lt;br /&gt;0x0DBF(3.40-4.84)&lt;br /&gt;0x0E69(3.40-4.84)&lt;br /&gt;0x0F29(3.40-4.84)&lt;br /&gt;0x0F38(3.41-4.84)&lt;br /&gt;0x065D&lt;br /&gt;0x0832(3.00-4.84)&lt;br /&gt;0x08A0&lt;br /&gt;0x08C2&lt;br /&gt;0x0918 || 'SoftID'<br /> |-<br /> | 0x10 || 0x8 || 0x0001000000000004&lt;br /&gt;0x0001000000000005&lt;br /&gt;0x0001000000000006&lt;br /&gt;0x0001000100030002&lt;br /&gt;0x0001000100030003&lt;br /&gt;0x0001000200030002&lt;br /&gt;0x0001000300030002&lt;br /&gt;0x0001000400040002&lt;br /&gt;0x0001000500000002&lt;br /&gt;0x0001000500010001&lt;br /&gt;0x00010002083E0832&lt;br /&gt; || 'PatchID'<br /> |-<br /> | 0x18 || 0x8 || 0x1000 || 'Content' Data Size<br /> |-<br /> | 0x20 || 0x8 || 0x1000 || 'Content' Compressed Data Size<br /> |-<br /> | 0x28 || 0x8 || 0x0 || <br /> |-<br /> | 0x30 || 0x10 || 0x0 || <br /> |-<br /> |}<br /> <br /> Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case.<br /> <br /> Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs<br /> <br /> ==='info1'===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> | 0x00 || 0x4 || 0x0 || <br /> |-<br /> | 0x04 || 0x4 || 0x3 || <br /> |-<br /> | 0x08 || 0x8 || 0x40 || Offset/size?<br /> |-<br /> | 0x10 || 0x4 || 0x0 || <br /> |-<br /> | 0x14 || 0x4 || 0x0 || <br /> |-<br /> | 0x18 || 0x8 || 0x1000 || 'Content' Data Size?<br /> |-<br /> | 0x20 || 0x8 || 0x1 || <br /> |-<br /> | 0x28 || 0x8 || 0x1 || <br /> |-<br /> | 0x30 || 0x10 || 0x0 || <br /> |-<br /> |}<br /> ==='content' overview===<br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Length !! Value !! Description<br /> |-<br /> |-<br /> | 0x0 || 0x1000 || - || 'content'<br /> |-<br /> |}<br /> <br /> == Known Retail syscon update packages ==<br /> These are in full Retail/CEX and Debug/DEX firmwares:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! [[Motherboard Revisions|Board]] !! [[Syscon Hardware]] !! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.75 !! SoftID or Syscon Revision !! Notes<br /> |-{{cellcolors|lightgrey}}<br /> ! rowspan=3 | [[COK-00x#COK-001|COK-001]] !! rowspan=3 | [[CXR713120-201GB]]<br /> | SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000005.pkg<br /> |-{{cellcolors|lightgrey}}<br /> | SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000006.pkg<br /> |-<br /> | SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0B8E || <br /> |-{{cellcolors|lightgrey}}<br /> ! rowspan=2 | [[COK-00x#COK-002|COK-002]] || rowspan=2 | [[CXR713120-201GB]]&lt;br /&gt;[[CXR713120-202GB]]<br /> | SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0C16 || Superseded by SYS_CON_FIRMWARE_01010303.pkg<br /> |-<br /> | SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0C16 || <br /> |-<br /> ! [[SEM-00x|SEM-001]] || [[CXR713120-201GB]]&lt;br /&gt;[[CXR713120-202GB]]&lt;br /&gt;[[CXR713120-203GB]]<br /> | SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0D52 || <br /> |-<br /> ! [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]]<br /> | SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0DBF || <br /> |-<br /> ! [[DIA-00x#DIA-002|DIA-002]] / [[DEB-00x#DEB-001|DEB-001]] || [[CXR714120-301GB]]&lt;br /&gt;[[CXR714120-302GB]]<br /> | SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0E69 || <br /> |-<br /> ! ??? || ???<br /> | SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0F29 || rowspan=2 | CXR714120-X0XGB / SW-30x Prototype<br /> |-<br /> ! ??? || ???<br /> | SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || 0F38<br /> |-<br /> ! [[VER-00x|VER-001]] || [[SW-30x]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 065D || <br /> |-<br /> ! [[DYN-00x|DYN-001]] || rowspan=4 | [[SW2-30x]]<br /> | SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || 0832 || rowspan=2 | ps3 2k series<br /> |-<br /> ! [[SUR-00x|SUR-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08A0<br /> |-<br /> ! [[JTP-00x|JTP-001]]&lt;br /&gt;[[JSD-00x|JSD-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08C2 || ps3 2k5 series<br /> |-<br /> ! [[KTE-00x|KTE-001]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0918 || ps3 3k series<br /> |-<br /> ! [[MSX-00x|MSX-001]]&lt;br /&gt;[[MPX-00x|MPX-001]] || [[SW3-30x]]<br /> | || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 098F || ps3 4k series<br /> |}<br /> <br /> This means from syscon perspective notible firmware changes where made at 1.30, 1.81, 3.00, 3.40 and 3.41 that affected retail and debug PS3 models<br /> *Firmware 1.30 (December 6, 2006) added Backup/Restore<br /> *Firmware 1.81 (June 15, 2007) ?<br /> *Firmware 3.00 (September 1, 2009) resulted in Class action suit for BluRay reading problems<br /> *Firmware 3.40 (June 29, 2010) ?<br /> *Firmware 3.41 (July 26, 2010) ?<br /> <br /> == NonRetail syscon ==<br /> Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the [[DECR-1000A]] TOOL/DECR).<br /> <br /> Tool/DECR don't have patches, they flash entire firmwares.&lt;br /&gt;<br /> <br /> Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)&lt;br&gt;<br /> it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see [[Talk:Communication_Processor]] for more info on how to downgrade)&lt;br&gt;<br /> <br /> DECR samples: [https://mega.co.nz/#!g50S1LRD!g8n1C191ax61YibnLEHJCQ63fT_ye1hA4Dhhrfulfs0] [https://mega.co.nz/#!jgVVCYZC!HaUXkeKFJNbzxAVkbO-Aj5LC2-yriY7rmUWKljlEQ40 mirror]:<br /> v0.6.1c8_TMU510_u.bin | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE<br /> v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91<br /> v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D<br /> v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5<br /> v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49<br /> v0.8.4c8_TMU510_u.bin | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E<br /> v0.9.9c1_TMU510_u.bin | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464<br /> v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9<br /> v1.0.1c1_TMU510_u.bin | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF<br /> v1.0.3c1_TMU510_u.bin | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E<br /> v1.0.4c1_TMU510_u.bin | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513<br /> v1.0.5c1_TMU510_u.bin | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE<br /> <br /> === dev/hda ===<br /> dev_hda.image from [[DECR-1000A]] CP: [http://mega/content/secure.html#!shd2VBwI!aElpZXIMqxdAP0hw775sNhmkwJewVXafQvdFUGQ5Lgo dev_hda.image] [https://mega.co.nz/#!y8kWmSqR!4PPNen3bukLWt-EZm_zENT9G8Ey-Fi0YcaLHNey41m0 dev_hda.image.7z]<br /> <br /> ==== Partitions ====<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! device file !! size !! type<br /> |-<br /> | /dev/loop0p1 || 51 MB (50577408 bytes) || 0x89<br /> |-<br /> | /dev/loop0p2 || 8,7 MB (8650752 bytes) || Linux<br /> |-<br /> | /dev/loop0p3 || 32 MB (31981568 bytes) || Linux<br /> |-<br /> | /dev/loop0p4 || 35 MB (35127296 bytes) || Extended<br /> |-<br /> | /dev/loop0 || 4,9 MB (4883968 bytes) || Unassigned<br /> |-<br /> |}<br /> <br /> === Deviating from Retail ===<br /> Please note that without info about the SKU the listing of ID's is pretty useless<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.11 !! SoftID !! Notes<br /> |-<br /> | ? || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B67 || Debug/DEX<br /> |-<br /> |}<br /> <br /> == Usage ==<br /> <br /> The firmware PUP's contains a collection of patches for all the different hardware revisions of syscon's chips used in different motherboard models.<br /> <br /> The ps3swu.self (system updater) decides which applicable [[Syscon Hardware]] is present and installs the needed package update(s) accordingly (via updater manager ss service).<br /> <br /> Which syscon version and which patches are installed can be seen in [[More_System_Information]]<br /> <br /> == Decryption ==<br /> Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB).<br /> <br /> === Patch/Firmware Body Decryption/Hashing ===<br /> <br /> The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch<br /> <br /> We know that:<br /> <br /> * Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc)<br /> * Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables)<br /> * Authenticated regions uses a form of what seems to be some ECB with tweak xoring (as graf once said about XTS)<br /> * XTS was introduced in 2007 and SysCon from ps3 exists for far more time than that (2003)<br /> * XEX is a close relative of XTS that was introduced in 1984<br /> * PS4 uses XTS for Authenticated Regions or SNVS (with sector size of 0x20 being used. is this even considered safe?)<br /> * 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50)<br /> * here are the DPA bytes for each of the controlable sections:<br /> * 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001)<br /> * 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001)<br /> * 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content)<br /> * 7B FC 27 CD D5 9A 05 09 3A DF E4 75 BF FD 03 1A (section 3/header AA from DEB-001 patch content)<br /> * 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content)<br /> * 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward)<br /> * 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse)<br /> * 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward)<br /> * 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER)<br /> * some bytes are considered &quot;weak&quot; bytes and should be bruteforced in the eventuality these keys fail<br /> * another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc<br /> * since key expansions take 10 &quot;hills&quot; in the analysis, it should be safe to assume that AES-128 is used(because it uses 10 rounds).<br /> * 6554cff202c3bfdd9740901070b705bf : correct md5 for patch content we are trying keys on (DIA-001)<br /> * 4875ad06a1499cc516a0d4d92e595794 : correct md5 for patch content we are trying keys on (DEB-001/DIA-002)<br /> * trying a different header/body patch content from another similar board will result into failure of decrypting body, which means that the header is checked for authenticity and that the header hash is NOT in the header<br /> * altering the patch header doesn't cause the patch header dpa bytes to change (a test was done with 4 bytes and the result was 16 32 47 79, which matches the other patch dpa recovered bytes)<br /> * there are in fact not 4 but 5 aes sections. the last one seems to be body related, as changing the body even one bit makes the last aes section disappear.<br /> * section 2 is divided into two sections, corresponding to TopHalf and BottomHalf of patch area.<br /> * TopHalf uses forward ttables/sbox. BottomHalf uses inverse ttables/sbox<br /> * TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10)<br /> * BottomHalf is the rest of the body itself.<br /> <br /> == Header ==<br /> The header format is partially unknown at this stage.<br /> All the Firmwares patches are written in little endian.<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Offset !! Length !! Notes !! Related DECR Error !! Notes<br /> |-<br /> | 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) ||<br /> |-<br /> | 0x4 || 0x10 || Header CMAC1 || FFFFFED1 (Header Check Error) || CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes and where Header CMAC2 is zeroed Concatenated with Encrypted Body <br /> |-<br /> | 0x14 || 0x10 || Header CMAC2 || FFFFFED1 (Header Check Error) || CMAC of Header (where this cmac has been zeroed)<br /> |-<br /> | 0x24 || 0x4 || Padding || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x28 || 0x4 || Total size || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x2c || 0x4 || Size of binary || FFFFFED1 (Header Check Error) ||<br /> |-<br /> | 0x30 || 0x10 || IV for AES-128 CBC || FFFFFED1 (Header Check Error) || <br /> |-<br /> | 0x40 || 0xfc0 || Encrypted binary || FFFFFED0 (Data Check Error) / FFFFFECF (Data Size Check Error) ||<br /> |-<br /> |}<br /> <br /> * Note: For the weird bogus update ONLY: FFFFFF37 (Alignment Error?) (Trying any data size between 0x41 and 0x4C bytes)<br /> * Note2: v0.6.14c4 is the bogus update (only update with a weird header)<br /> * Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0<br /> <br /> === Samples ===<br /> &lt;pre&gt;<br /> 00000000 1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D .-p.«^³™h þ=á€j.<br /> 00000010 B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA ¸ý7ÏÍE…«Q÷.ãê2¥ê<br /> 00000020 67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00 gEùH........À...<br /> 00000030 8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D ‹..ù›¢.:u‰ñB.YÚ.<br /> 00000040 21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63 !|¢ÃZäx...K÷¢sœc<br /> 00000050 5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA ].]I.Ço,.3þ.Ól¡Ê<br /> 00000060 BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80 º.+þ.3q×Åæ\ÿ¿wl€<br /> 00000070 F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48 ò¾.»&lt;RRÜ©hå$.OóH<br /> &lt;/pre&gt;<br /> <br /> -From v1.0.4c2_TMU510_u-<br /> &lt;pre&gt;<br /> 00000000 73 79 73 31 73 47 59 5D FB 85 3B 7B 4A 28 10 5D sys1sGY]û…;{J( ]<br /> 00000010 46 EE 8C 01 3C B4 F1 82 1E 18 4F B7 4A 56 FC C7 FîŒ &lt;´ñ‚ O·JVüÇ<br /> 00000020 FF 83 0B E0 00 00 00 00 40 00 06 00 00 00 06 00 ÿƒ à @ <br /> 00000030 69 B6 02 69 3A 97 8B 1C 4E 18 D4 E0 63 7D CA 94 i¶ i:—‹ N Ôàc}Ê”<br /> 00000040 4B A0 79 34 79 41 BD 09 BB 68 D4 0A A0 B7 05 78 K y4yA½ »hÔ  · x<br /> 00000050 D9 8F 8F 28 6C 9A 1B 61 CF A1 E7 49 7D CA C4 A3 Ù (lš aÏ¡çI}ÊÄ£<br /> 00000060 A4 4D 4B E0 AE 48 86 03 B1 43 F2 47 C0 C4 1D 4F ¤MKà®H† ±CòGÀÄ O<br /> 00000070 FA E8 43 A7 1E 6E 79 8C E5 FF 04 20 E9 44 09 B5 úèC§ nyŒåÿ éD µ<br /> &lt;/pre&gt;<br /> <br /> === Observations ===<br /> * The first 4 bytes (0x1B2D700F) appear static in each package.<br /> * The next 0x20 bytes appear to change with each package<br /> * The following 12 bytes (0x0000000000100000C00F0000) also appear static, but it's the firmware size and fw size - header size; infact if correctly converted to little endian 00000000 00001000 00000fc0, where 00000000 is Unknown, 00001000 is 4096 in dec (file size) and 00000fc0 is 4032 in dec (update size).<br /> * On the DECH fw, the update works in the same way: 000000004000060000000600 converted will be: 00000000 00060040 00060000, where, 00000000 is probably padding, file size 00060040, 00060000 update size<br /> * the first 0x40 bytes probably are IV + HASH + update infos. probably the algorithm used is AES.<br /> * algorithm used is aes 128 cbc on the body (iv is at + 0x30)<br /> <br /> == Access to Syscon from Linux ==<br /> Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON<br /> <br /> == List of Soft IDs in Decimal Form ==<br /> &lt;pre&gt;<br /> 2958<br /> 3094<br /> 3410<br /> 3519<br /> 3689<br /> 3881<br /> 3896<br /> &lt;/pre&gt;<br /> <br /> == Placeholder for bga patch key generation ==<br /> <br /> &lt;pre&gt;<br /> 34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 4:....__SCEISYS1<br /> &lt;/pre&gt;<br /> <br /> * replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id<br /> <br /> * replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id<br /> <br /> = PTCH Firmware TOC =<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> !Offset!!Size!!Notes!!Number<br /> |-<br /> | 0x00 || 0x2 || Major Version || 1<br /> |-<br /> | 0x02 || 0x2 || Minor Version || 1<br /> |- <br /> | 0x04 || 0x2 || Major Revision || 1<br /> |-<br /> | 0x06 || 0x2 || Minor Revision || 1<br /> |-<br /> | 0x08 || 0x10 || PTCH Addresses || 4*4<br /> |-<br /> | 0x18 || 0x4 || PTCH #1 Instruction / Data || 1 <br /> |-<br /> | 0x1C || 0x4 || PTCH #2 Instruction / Data || 1<br /> |-<br /> | 0x20 || 0x4 || PTCH #3 Instruction / Data || 1<br /> |-<br /> | 0x24 || 0x4 || PTCH #4 Instruction / Data || 1<br /> |-<br /> | 0x28 || 0x10 || Additional PTCH Instruction Addresses || 4*4<br /> |-<br /> | 0x38 || 0x388 || Additional PTCH Instructions || 1<br /> |-<br /> | 0x3C0 || 0xC00 || HDMI Related PTCH Instructions || 1<br /> |-<br /> |}<br /> <br /> = External commands =<br /> <br /> &lt;pre&gt;<br /> 0x333C5 BOOT MODE 0x000080D6<br /> 0x33441 BOOT CONT 0x000080D5<br /> 0x34EA9 SHUTDOWN 0x0000C0D5<br /> 0x334BD HALT 0x0000C0D5<br /> 0x334F1 BOOTENABLE 0x0000809A<br /> 0x33F5F AUTH1 0x0000C0EF<br /> 0x33FF5 AUTH2 0x0000C0EF<br /> 0x340EB AUTHVER SET 0x0000C0DF<br /> 0x34091 AUTHVER GET 0x0000C0FF<br /> 0x3352F EEP INIT 0x000080DA<br /> 0x336BD EEP SET 0x0000C0DF<br /> 0x337DF EEP GET 0x0000C0DF<br /> 0x33A71 PDAREA SET 0x0000C0DF<br /> 0x338F7 PDAREA GET 0x0000C0DF<br /> 0x33B85 CSAREA SET 0x0000C0DF<br /> 0x33B19 CSAREA GET 0x0000C0DF<br /> 0x33C29 VID GET 0x0000C0D5<br /> 0x33C97 CID GET 0x0000C0D5<br /> 0x33CDD ECID GET 0x0000C0D5<br /> 0x33D1D REV SB 0x0000C0D5<br /> 0x33D4D SPU INFO 0x0000C0D5<br /> 0x33DA1 KSV 0x0000C0D5<br /> 0x34157 FAN SETPOLICY 0x0000C0D7<br /> 0x341E5 FAN GETPOLICY 0x0000C0D7<br /> 0x3424F FAN START 0x0000C0D7<br /> 0x3424F FAN STOP 0x0000C0D7<br /> 0x34425 FAN SETDUTY 0x0000C0D7<br /> 0x34493 FAN GETDUTY 0x0000C0D7<br /> 0x344F5 R8 0x0000C0DF<br /> 0x3459F W8 0x0000C0DF<br /> 0x3463F R16 0x0000C0DF<br /> 0x346E7 W16 0x0000C0DF<br /> 0x34789 R32 0x0000C0DF<br /> 0x3492F W32 0x0000C0DF<br /> 0x349CF RBE 0x0000C0D5<br /> 0x34A77 WBE 0x0000C0D5<br /> 0x34B2F PORTSTAT 0x0000C0DF<br /> 0x33D7F VER 0x0000C0FF<br /> 0x34CAD BUZ 0x00008096<br /> 0x34CE1 BTNEMU SYNC 0x0000C0D7<br /> 0x34CE1 BTNEMU ASYNC 0x0000C0D7<br /> 0x34EA9 SERVFAN 0x0000C0D7<br /> 0x34D6F ERRLOG START 0x0000C0DF<br /> 0x34D93 ERRLOG STOP 0x0000C0DF<br /> 0x34DB7 ERRLOG GET 0x0000C0FF<br /> 0x34E1D ERRLOG CLEAR 0x0000C0DF<br /> 0x34E41 NONFATALERR 0x0000C0DF<br /> &lt;/pre&gt;<br /> {{Custom Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=54169 SC EEPROM 2019-08-12T16:56:22Z <p>93.108.187.41: /* PTCH Body */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3100-0x31FF || Special Region #0 ||<br /> |-<br /> | 0x3200-0x32FF || Special Region #1 ||<br /> |-<br /> | 0x3300-0x33FF || Special Region #2 || 3JMPRW<br /> |-<br /> | 0x3400-0x34FF || Special Region #3 || 3JMPRW<br /> |-<br /> | 0x3500-0x35FF || Special Region #4 || .....z<br /> |-<br /> | 0x3600-0x36FF || Special Region #5 || ...,.z<br /> |-<br /> | 0x3700-0x370F / 0x3700-0x37FF || Serial Num (DECR only) / Special Region #6 || 2M010001207K / 2D@ 40@ <br /> |-<br /> | 0x3710 - 0x37FF || FF Region (DECR only) ||<br /> |-<br /> | 0x3800-0x38FF || FF Region || <br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> == PTCH Body ==<br /> <br /> === SEM-001 ===<br /> <br /> &lt;pre&gt;<br /> 0000000 0001 0002 0003 0002 341c 0003 11b8 0002<br /> 0000010 dddd dddd cccc cccc 28ee d001 d00d dff1<br /> 0000020 dddd dddd cccc cccc ffff ffff f078 0200<br /> 0000030 dddd dddd cccc cccc 1fff e8bd 1fbf e92d<br /> 0000040 0004 e28f 8002 e1a0 001e ea00 6007 e1a0<br /> 0000050 300c e3a0 0396 e003 60ac e59f 6000 e596<br /> 0000060 6006 e083 3004 e086 3020 e243 301f e5d3<br /> 0000070 0005 e153 0010 ba00 5000 e3a0 5000 e581<br /> 0000080 8000 e3a0 0002 e158 0008 0a00 0000 e28f<br /> 0000090 000c ea00 5000 e591 50ff e285 506e e285<br /> 00000a0 5007 e085 5000 e581 8001 e288 fff4 eaff<br /> 00000b0 1fbf e8bd 2054 e59f f002 e1b0 1fbf e8bd<br /> 00000c0 004c e59f f000 e1b0 0000 e358 000a 0a00<br /> 00000d0 3008 e1a0 000a e353 0001 ba00 300a e243<br /> 00000e0 fffb eaff 0004 e353 0001 ba00 3004 e243<br /> 00000f0 fffb eaff 0000 e353 0001 0a00 7000 e3a0<br /> 0000100 ff10 e12f 7001 e3a0 ff10 e12f 123c 0002<br /> 0000110 11ea 0002 11d6 0002 f3f4 f1f2 f3f4 f1f2<br /> 0000120 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2<br /> *<br /> 0000fc0<br /> &lt;/pre&gt;<br /> <br /> === DIA-001 ===<br /> <br /> &lt;pre&gt;<br /> 0000000 0001 0003 0003 0002 3740 0003 1074 0002<br /> 0000010 dddd dddd cccc cccc 28ee d001 d00d dff1<br /> 0000020 dddd dddd cccc cccc ffff ffff f078 0200<br /> 0000030 dddd dddd cccc cccc 1fff e8bd 1fbf e92d<br /> 0000040 0004 e28f 8002 e1a0 001e ea00 6007 e1a0<br /> 0000050 300c e3a0 0396 e003 60ac e59f 6000 e596<br /> 0000060 6006 e083 3004 e086 3020 e243 301f e5d3<br /> 0000070 0005 e153 0010 ba00 5000 e3a0 5000 e581<br /> 0000080 8000 e3a0 0002 e158 0008 0a00 0000 e28f<br /> 0000090 000c ea00 5000 e591 50ff e285 506e e285<br /> 00000a0 5007 e085 5000 e581 8001 e288 fff4 eaff<br /> 00000b0 1fbf e8bd 2054 e59f f002 e1b0 1fbf e8bd<br /> 00000c0 004c e59f f000 e1b0 0000 e358 000a 0a00<br /> 00000d0 3008 e1a0 000a e353 0001 ba00 300a e243<br /> 00000e0 fffb eaff 0004 e353 0001 ba00 3004 e243<br /> 00000f0 fffb eaff 0000 e353 0001 0a00 7000 e3a0<br /> 0000100 ff10 e12f 7001 e3a0 ff10 e12f 10f8 0002<br /> 0000110 10a6 0002 1092 0002 f3f4 f1f2 f3f4 f1f2<br /> 0000120 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2<br /> *<br /> 0000fc0<br /> &lt;/pre&gt;<br /> <br /> === DIA-002 ===<br /> <br /> &lt;pre&gt;<br /> 0000000 0001 0004 0004 0002 3e90 0003 1204 0002<br /> 0000010 dddd dddd cccc cccc 28ee d001 d00d dff1<br /> 0000020 dddd dddd cccc cccc ffff ffff f078 0200<br /> 0000030 dddd dddd cccc cccc 1fff e8bd 1fbf e92d<br /> 0000040 0004 e28f 8002 e1a0 001e ea00 6007 e1a0<br /> 0000050 300c e3a0 0396 e003 60ac e59f 6000 e596<br /> 0000060 6006 e083 3004 e086 3020 e243 301f e5d3<br /> 0000070 0005 e153 0010 ba00 5000 e3a0 5000 e581<br /> 0000080 8000 e3a0 0002 e158 0008 0a00 0000 e28f<br /> 0000090 000c ea00 5000 e591 50ff e285 506e e285<br /> 00000a0 5007 e085 5000 e581 8001 e288 fff4 eaff<br /> 00000b0 1fbf e8bd 2054 e59f f002 e1b0 1fbf e8bd<br /> 00000c0 004c e59f f000 e1b0 0000 e358 000a 0a00<br /> 00000d0 3008 e1a0 000a e353 0001 ba00 300a e243<br /> 00000e0 fffb eaff 0004 e353 0001 ba00 3004 e243<br /> 00000f0 fffb eaff 0000 e353 0001 0a00 7000 e3a0<br /> 0000100 ff10 e12f 7001 e3a0 ff10 e12f 1288 0002<br /> 0000110 1236 0002 1222 0002 f3f4 f1f2 f3f4 f1f2<br /> 0000120 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2<br /> *<br /> 0000fc0<br /> &lt;/pre&gt;<br /> <br /> == Authenticated Regions ==<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=53979 SC EEPROM 2019-07-18T15:45:14Z <p>93.108.187.41: /* Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3100-0x31FF || Special Region #0 ||<br /> |-<br /> | 0x3200-0x32FF || Special Region #1 ||<br /> |-<br /> | 0x3300-0x33FF || Special Region #2 || 3JMPRW<br /> |-<br /> | 0x3400-0x34FF || Special Region #3 || 3JMPRW<br /> |-<br /> | 0x3500-0x35FF || Special Region #4 || .....z<br /> |-<br /> | 0x3600-0x36FF || Special Region #5 || ...,.z<br /> |-<br /> | 0x3700-0x370F / 0x3700-0x37FF || Serial Num (DECR only) / Special Region #6 || 2M010001207K / 2D@ 40@ <br /> |-<br /> | 0x3710 - 0x37FF || FF Region (DECR only) ||<br /> |-<br /> | 0x3800-0x38FF || FF Region || <br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=53978 SC EEPROM 2019-07-18T15:42:09Z <p>93.108.187.41: /* Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3100-0x31FF || Special Region #0 ||<br /> |-<br /> | 0x3200-0x32FF || Special Region #1 ||<br /> |-<br /> | 0x3300-0x33FF || Special Region #2 || 3JMPRW<br /> |-<br /> | 0x3400-0x34FF || Special Region #3 || 3JMPRW<br /> |-<br /> | 0x3500-0x35FF || Special Region #4 || .....z<br /> |-<br /> | 0x3600-0x36FF || Special Region #5 || ...,.z<br /> |-<br /> | 0x3700-0x370F / 0x3700-0x37FF || Serial Num (DECR only) / Special Region #6 || 2M010001207K / 2D@ 40@ <br /> |-<br /> | 0x3710 - 0x37FF || FF Region (DECR only) ||<br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=53977 SC EEPROM 2019-07-18T15:39:44Z <p>93.108.187.41: /* Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3100-0x31FF || Special Region #0 ||<br /> |-<br /> | 0x3200-0x32FF || Special Region #1 ||<br /> |-<br /> | 0x3300-0x33FF || Special Region #2 || 3JMPRW<br /> |-<br /> | 0x3400-0x34FF || Special Region #3 || 3JMPRW<br /> |-<br /> | 0x3500-0x35FF || Special Region #4 || .....z<br /> |-<br /> | 0x3600-0x36FF || Special Region #5 || ...,.z<br /> |-<br /> | 0x3700-0x370F || Serial Num (DECR only) || 2M010001207K<br /> |-<br /> | 0x3710 - 0x37FF || FF Region (DECR only) ||<br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=53976 SC EEPROM 2019-07-18T15:30:29Z <p>93.108.187.41: /* Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3700-0x370F || Serial Num (DECR only) || 2M010001207K<br /> |-<br /> | 0x3710 - 0x37FF || FF Region (DECR only) ||<br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=53975 SC EEPROM 2019-07-18T15:20:40Z <p>93.108.187.41: /* Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3700-0x370F || Serial Num (DECR only) || 2M010001207K<br /> |-<br /> | 0x3710 - 0x37FF || FF Region ||<br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=SC_EEPROM&diff=53974 SC EEPROM 2019-07-18T15:16:48Z <p>93.108.187.41: /* Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) */</p> <hr /> <div>Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] <br /> <br /> Here is where system flags, tokens and hashes are stored.<br /> <br /> Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.<br /> <br /> See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]<br /> <br /> = SC EEPROM Info =<br /> SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.<br /> We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like &quot;'''Logic Analyzer'''&quot;, &quot;'''Protocol Analyzer'''&quot;, &quot;'''Custom made MCU boards'''&quot; to capture traffic between console and Syscon EEPROM.<br /> <br /> For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.<br /> So the total EEPROM size is: 0x8000 byte length.<br /> <br /> And since the pin-out of Syscon chip for Slim &amp; Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.<br /> <br /> == SC EEPROM Commands ==<br /> <br /> FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Description!! Command !! Note<br /> |-<br /> | Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.<br /> |-<br /> | Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).<br /> |-<br /> | Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.<br /> |-<br /> | Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.<br /> |}<br /> <br /> = SC EEPROM dumps =<br /> * https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}<br /> * https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})<br /> * https://mega.co.nz/#!t50DCIiL!RYLvjm35nmH3JVfhsGIXFWVHxmCr07ERsFBWhAOxD_Q {{MD5|95DDFB21D65E38F20CD66517B67EAE7F}}<br /> * https://mega.co.nz/#!x4V0XBgJ!inxGYA5s8lfAF5Pe-naKCzTa1r5pY8Pn18js3D7QlnI<br /> <br /> * https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me &quot;'''Abkarino'''&quot; using Arduino Mega).<br /> <br /> * https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.<br /> <br /> different consoles, same initial 16 bytes. maybe key/iv?<br /> <br /> =Important Offsets=<br /> <br /> == EEPROM Offset Table - Flags and Tokens ==<br /> <br /> Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x02F00 || 8 || Manufacturing Update Release Version String<br /> |-<br /> | 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String<br /> |-<br /> | 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the &lt;br&gt;manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)<br /> |-<br /> | 0x02F28 || 0xD0 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx <br /> xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx <br /> xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <br /> FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00 <br /> xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 &lt;/pre&gt;<br /> |-<br /> | 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))<br /> |-<br /> | 0x02FF9 || 0x7 || Padding/undocumented<br /> &lt;pre&gt;00 00 00 00 xx xx xx &lt;/pre&gt;<br /> |-<br /> |}<br /> <br /> <br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! colspan=&quot;2&quot; | Offset !! Size !! Description<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48000 || 0x13 || (lv0 NVS region 0 start) <br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 0: 0x48000-0x48012&quot;&gt;&lt;small&gt;0&lt;/small&gt;&lt;/abbr&gt; || 0x48000 || 0x13 || (lv0 NVS region 0)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48012 || - || (lv0 NVS region 0 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48013 || 0x2A || QA Token ECDSA Signature (=&amp;gt; 3.60 firmwares)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48800 || 0x0F || (lv0 NVS region 1 start) <br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 1: 0x48800-0x4880F&quot;&gt;&lt;small&gt;1&lt;/small&gt;&lt;/abbr&gt; || 0x48800 || 1 || ?<br /> |-<br /> | 0x48801 || 1 || - hv log settings/infos? -<br /> |-<br /> | 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)<br /> |-<br /> | 0x48804 || 4 || bootrom failure code <br /> |-<br /> | 0x48808 || 4 || bootrom failure timestamp <br /> |-<br /> | 0x4880C || 4 || ?<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x4880B || - || (lv0 NVS region 1 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C00 || 0x20 || (lv0 NVS region 2 start) <br /> |-<br /> | rowspan=&quot;22&quot; | &lt;abbr title=&quot;lv0 NVS region 2: 0x48C00-0x48C1F&quot;&gt;&lt;small&gt;2&lt;/small&gt;&lt;/abbr&gt; || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)<br /> |-<br /> | 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) <br /> |-<br /> | 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid &lt;!-- used on retail consoles --&gt;))<br /> |-<br /> | 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) <br /> |-<br /> | 0x48C04 || 1 || used to reset dgbe_config (only &lt;= 0.85)<br /> |-<br /> | 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format 0)<br /> |-<br /> | 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)<br /> |-<br /> | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)<br /> |-<br /> | 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on &gt;= 0.82, maybe only CEB) <br /> |-<br /> | 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)<br /> |-<br /> | 0x48C0A || 1 || QA Flag exist flag<br /> |-<br /> | 0x48C0B || 1 || mode_auth_flag / gx enable<br /> |-<br /> | 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))<br /> |-<br /> | 0x48C0D || 1 || Memory Diag Status (lv0ldr related)<br /> |-<br /> | 0x48C0E || 1 || XDR_Link_Init failure flag<br /> |-<br /> | 0x48C0F || 2 || cell os flags (loader parameter)<br /> |-<br /> | 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)<br /> |-<br /> | 0x48C12 || 1 || ?<br /> |-<br /> | 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))<br /> |-<br /> | 0x48C14 || 4 || cellos_spu_configure<br /> |-<br /> | 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )<br /> |-<br /> | 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C1F || - || (lv0 NVS region 2 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C22 || 0x03 || (lv0 NVS region 3 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 3: 0x48C22-0x48C24&quot;&gt;&lt;small&gt;3&lt;/small&gt;&lt;/abbr&gt; || 0x48C22 || 1 || be nclk (be_nclck_flag1)<br /> |-<br /> | 0x48C23 || 1 || be ref clk (be_nclck_flag2)<br /> |-<br /> | 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C24 || - || (lv0 NVS region 3 end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C25 || 1 || Bank #0 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C26 || 1 || Bank #0 rvkpkg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C27 || 1 || Bank #1 OS-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C28 || 1 || Bank #1 rvkprg-Flag<br /> |-<br /> | colspan=&quot;2&quot; | 0x48C29 || 1 || Bank #1 rvkpkg-Flag<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C30 || 0x0D || (lv0 NVS region 4 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 4: 0x48C30-0x48C3C&quot;&gt;&lt;small&gt;4&lt;/small&gt;&lt;/abbr&gt; || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)<br /> |-<br /> | 0x48C31 || 4 || sata param<br /> |-<br /> | 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C3C || - || (lv0 NVS region 4 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C40 || 0x10 || (lv0 NVS region 5 start)<br /> |-<br /> | rowspan=&quot;8&quot; | &lt;abbr title=&quot;lv0 NVS region 5: 0x48C40-0x48C4F&quot;&gt;&lt;small&gt;5&lt;/small&gt;&lt;/abbr&gt; || 0x48C42 || 1 || HDD Copy Mode<br /> |-<br /> | 0x48C43 || 4 || Hdd Ident Information<br /> |-<br /> | 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon<br /> |-<br /> | 0x48C50 || 0x10 || Debug Support Flag<br /> |-<br /> | 0x48C60 || 1 || Update Status<br /> |-<br /> | 0x48C61 || 1 || Recover Mode Flag<br /> |-<br /> | 0x48C62 || 8 || boot param<br /> |-<br /> | 0x48C6A || 2 || factory process completion %<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C4F || - || (lv0 NVS region 5 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C80 || 0x10 || (lv0 NVS region 6 start)<br /> |-<br /> | rowspan=&quot;2&quot; | &lt;abbr title=&quot;lv0 NVS region 6: 0x48C80-0x48C8F&quot;&gt;&lt;small&gt;6&lt;/small&gt;&lt;/abbr&gt; || 0x48C80 || 8 || (rsx.rdcy.0)<br /> |-<br /> | 0x48C88 || 8 || (rsx.rdcy.1)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48C8F || - || (lv0 NVS region 6 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48C90 || 0x30 || (lv0 NVS region 7 start)<br /> |-<br /> | rowspan=&quot;6&quot; | &lt;abbr title=&quot;lv0 NVS region 7: 0x48C90-0x48CBF&quot;&gt;&lt;small&gt;7&lt;/small&gt;&lt;/abbr&gt; || 0x48C90 || 8 || (rsx.rdcy.2)<br /> |-<br /> | 0x48C98 || 8 || (rsx.rdcy.3)<br /> |-<br /> | 0x48CA0 || 8 || (rsx.rdcy.4)<br /> |-<br /> | 0x48CA8 || 8 || (rsx.rdcy.5)<br /> |-<br /> | 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read<br /> |-<br /> | 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CBF || - || (lv0 NVS region 7 end)<br /> |-<br /> <br /> | colspan=&quot;2&quot; | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)<br /> |-<br /> | colspan=&quot;2&quot; | 0x48CCF || 1 || pme_user debug printf flag ( &amp; 0x03 verbose level )<br /> |-{{cellcolors|lightgrey}}<br /> <br /> | colspan=&quot;2&quot; | 0x48CF0 || 0x10 || (NVS region start)<br /> |-<br /> | rowspan=&quot;16&quot; | &lt;abbr title=&quot;NVS region: 0x48CF0-0x48CFF&quot;&gt;&lt;small&gt;&lt;/small&gt;&lt;/abbr&gt; || 0x48CF0 || 1 || ss.common.printf.enabled<br /> |-<br /> | 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level<br /> |-<br /> | 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level<br /> |-<br /> | 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level<br /> |-<br /> | 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level<br /> |-<br /> | 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level<br /> |-<br /> | 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level<br /> |-<br /> | 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level<br /> |-<br /> | 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level<br /> |-<br /> | 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level<br /> |-<br /> | 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level<br /> |-<br /> | 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level<br /> |-<br /> | 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level<br /> |-<br /> | 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level<br /> |-<br /> | 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu<br /> |-<br /> | 0x48CFF || 1 || ss.token.debug.level<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48CFF || - || (NVS region end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D00 || 0x0C || (lv0 NVS region 8 start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region 8: 0x48D00-0x48D0B&quot;&gt;&lt;small&gt;8&lt;/small&gt;&lt;/abbr&gt; || 0x48D00 || 4 || ip_addr (dgbe_config)<br /> |-<br /> | 0x48D04 || 4 || ip_netmask<br /> |-<br /> | 0x48D08 || 4 || ip_gateway<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D0B || - || (lv0 NVS region 8 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D20 || 0x08|| (lv0 NVS region 9 start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region 9: 0x48D20-0x48D27&quot;&gt;&lt;small&gt;9&lt;/small&gt;&lt;/abbr&gt; || 0x48D20 || 8 || spider.gbe0.macaddr.0 (&lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D27 || - || (lv0 NVS region 9 end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D28 || 0x18 || (lv0 NVS region B start)<br /> |-<br /> | rowspan=&quot;3&quot; | &lt;abbr title=&quot;lv0 NVS region B: 0x48D28-0x48D3F&quot;&gt;&lt;small&gt;B&lt;/small&gt;&lt;/abbr&gt; || 0x48D28 || 8 || spider.gbe0.macaddr.1 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D30 || 8 || spider.gbe0.macaddr.2 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-<br /> | 0x48D38 || 8 || spider.gbe0.macaddr.3 (&lt;code&gt;FFFFFFFFFFFFFFFF&lt;/code&gt; if unused/nonpresent)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D3F || - || (lv0 NVS region B end)<br /> |-{{cellcolors|lightgrey}}<br /> <br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D3E || 0x50 || (lv0 NVS region A start)<br /> |-<br /> | &lt;abbr title=&quot;lv0 NVS region A: 0x48D3E-0x48D8D&quot;&gt;&lt;small&gt;A&lt;/small&gt;&lt;/abbr&gt; || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)<br /> |-{{cellcolors|lightgrey}}<br /> | colspan=&quot;2&quot; | 0x48D8D || - || (lv0 NVS region A end)<br /> |-<br /> <br /> <br /> | colspan=&quot;2&quot; | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)<br /> |-<br /> |}<br /> <br /> In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)<br /> <br /> To change this to an active status you have to write 0x00 to turn on the flag<br /> <br /> Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM<br /> <br /> QA flag is tied to QA token that is also saved in this part of the SC EEPROM<br /> <br /> QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)<br /> <br /> == Undocumented config ==<br /> <br /> There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.<br /> &lt;pre&gt;<br /> 0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00 ÿ.ÿþÿ.ÿÿ.ûá..... <br /> 0010h: 17 74 B8 54 00 00 E1 18 00 04 00 00 0C 03 00 00 .t¸T..á......... <br /> 0020h: 3C 02 02 00 00 00 00 10 00 00 00 00 55 55 55 55 &lt;...........UUUU <br /> 0030h: 00 00 00 00 00 00 00 00 17 E0 C8 52 00 00 E2 18 .........àÈR..â. <br /> 0040h: 01 50 00 35 40 01 03 00 00 00 00 10 1D 30 00 B3 .P.5@........0.³ <br /> 0050h: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <br /> 0060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0080h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 0090h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00A0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00B0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00C0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00D0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00E0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> 00F0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ <br /> &lt;/pre&gt;<br /> <br /> This is 0x48800 on EEPROM<br /> <br /> cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w<br /> <br /> == lv0 SC EEPROM usage ==<br /> &lt;pre&gt;<br /> [*] lv0 NVS regions:<br /> # start_offset end_offset block size<br /> 0 0x00 0x12 0x48000 0x13<br /> 1 0x00 0x0B 0x48800 0x0C<br /> 2 0x00 0x1F 0x48C00 0x20<br /> 3 0x22 0x24 0x48C00 0x03<br /> 4 0x30 0x3C 0x48C00 0x0D<br /> 5 0x40 0x4F 0x48C00 0x10<br /> 6 0x80 0x8F 0x48C00 0x10<br /> 7 0x90 0xBF 0x48C00 0x30<br /> 8 0x00 0x0B 0x48D00 0x0C<br /> 9 0x20 0x27 0x48D00 0x08<br /> A 0x3E 0x8D 0x48D00 0x50<br /> B 0x28 0x3F 0x48D00 0x18<br /> <br /> [*] Example region data (taken from region cache):<br /> 2:<br /> 01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF<br /> FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00<br /> 3:<br /> FF FF 00<br /> 4:<br /> 06 18 18 17 18 FF FF FF FF FF FF FF FF<br /> 5:<br /> FF FF 0D 02 0A 02 FF FF FF FF FF FF FF FF FF FF<br /> 9:<br /> FF FF FF FF FF FF FF FF<br /> <br /> [*] lv0 SC EEPROM usage:<br /> name addr size structure<br /> UNKNOWN 0x48804 0x04 [0x04 value]<br /> os_boot_order_flag 0x48C00 0x01 [0x01 flag]<br /> select_net_device 0x48C02 0x01 [0x01 index]<br /> select_dgbe_device 0x48C03 0x01 [0x01 index]<br /> fself_ctrl 0x48C06 0x01 [0x01 flag]<br /> UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag]<br /> qaf_enable 0x48C0A 0x01 [0x01 flag]<br /> cellos_flags 0x48C0F 0x02 [0x02 flags]<br /> bootrom_trace_level 0x48C11 0x01 [0x01 level]<br /> flash_ext_format 0x48C13 0x01 [0x01 flag]<br /> be_nclck_flag1 0x48C22 0x01 [0x01 flag]<br /> be_nclck_flag2 0x48C23 0x01 [0x01 flag]<br /> os_bank_indicator 0x48C24 0x01 [0x01 flag]<br /> restrict_spu 0x48C30 0x01 [0x01 flag]<br /> sata_param 0x48C31 0x04 [0x04 flag]<br /> cellos_spu_configure 0x48C33 0x04 [0x04 config]<br /> spr_tbuw_value 0x48C35 0x08 [0x08 value]<br /> rsx.rdcy.0 0x48C80 0x08 [0x08 value]<br /> rsx.rdcy.1 0x48C88 0x08 [0x08 value]<br /> rsx.rdcy.2 0x48C90 0x08 [0x08 value]<br /> rsx.rdcy.3 0x48C98 0x08 [0x08 value]<br /> rsx.rdcy.4 0x48CA0 0x08 [0x08 value]<br /> rsx.rdcy.5 0x48CA8 0x08 [0x08 value]<br /> rsx.rdcy.6 0x48CB0 0x08 [0x08 value]<br /> rsx.rdcy.7 0x48CB8 0x08 [0x08 value]<br /> dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]<br /> qa_token 0x48D3E 0x50 [0x50 token]<br /> UNKNOWN 0x48D20 0x08 [0x08 value]<br /> &lt;/pre&gt;<br /> <br /> == System Data From EEPROM ==<br /> <br /> Here is the list of possible EEPROM offsets: <br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Index !! SC EEPROM Offset !! Size Of Data !! Description<br /> |-<br /> | 0 || 0x48D20 || 6 ||?<br /> |-<br /> | 1 || 0x48D28 || 6 ||?<br /> |-<br /> | 2 || 0x48D30 || 6 ||?<br /> |-<br /> | 3 || 0x48D38 || 6 ||?<br /> |-<br /> | 4 || 0x48D00 || 4 ||?<br /> |-<br /> | 5 || 0x48D04 || 4 ||?<br /> |-<br /> | 6 || 0x48D08 || 4 ||?<br /> |}<br /> <br /> == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==<br /> <br /> Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset<br /> |-<br /> | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000<br /> |-<br /> | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100<br /> |-<br /> | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200<br /> |-<br /> | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300<br /> |-<br /> | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || &quot;Industry Area&quot; aka OS Version Area || 0x2F00<br /> |-<br /> | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || &quot;Customer Service Area&quot; || 0x3000<br /> |-<br /> | N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity<br /> |-<br /> | All other offsets || Invalid || Invalid || ? ||<br /> |}<br /> <br /> == Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==<br /> <br /> {|class=&quot;wikitable&quot;<br /> |-<br /> ! Physical Offset !! Description !! Samples<br /> |-<br /> | 0x0-0xF || magic0 (static bytes) || &lt;pre&gt;99D9662BB3D761546B9C3F9ED140EDB0&lt;/pre&gt;<br /> |-<br /> | 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||<br /> |-<br /> | 0x2A0-0x4FF(0x260) || Unknown ||<br /> |- <br /> | 0x500-0x55F || magic1(static bytes) ||<br /> |-<br /> | 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||<br /> |-<br /> | 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,&lt;BR&gt; vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||<br /> |-<br /> | 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||<br /> |-<br /> | 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||<br /> |-<br /> | 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||<br /> |-<br /> | 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||<br /> |-<br /> | 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||<br /> |-<br /> | 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||<br /> |-<br /> | 0x2560-0x26AF || FF Region ||<br /> |-<br /> | 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) || <br /> |-<br /> | 0x26F0-0x26FF || FF Region || <br /> |-<br /> | 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || &lt;pre&gt;857C4DE5BFAFD6A4A361CB5BFDD72D26&lt;/pre&gt;<br /> |-<br /> | 0x2710-0x27FF || FF Region || <br /> |-<br /> | 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||<br /> |-<br /> | 0x2C00 - 0x2EFF || FF Region ||<br /> |-<br /> | 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||<br /> |-<br /> | 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||<br /> |-<br /> | 0x3700-0x370F || Serial Num (DECR only) || 2M010001207K<br /> |-<br /> | 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||<br /> |-<br /> | 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||<br /> |-<br /> | 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||<br /> |-<br /> | 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||<br /> |-<br /> | 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||<br /> |-<br /> | 0x5000-0x6FFF || FF Region ||<br /> |-<br /> |}<br /> <br /> == Authenticated Data Regions Crypto Analysis ==<br /> <br /> === Tests ===<br /> <br /> * http://i.imgur.com/A8g00bD.png &lt;- aes 128 cbc with fixed key and incremented iv (by 1 each time)<br /> * http://i.imgur.com/HZDWGSk.png &lt;- results<br /> * http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted<br /> * http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted<br /> <br /> === Conclusion ===<br /> <br /> * different key for a different authenticated region.<br /> * sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)<br /> * sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc<br /> * most likely the keys used are &lt;strike&gt;session&lt;/strike&gt; perconsole keys.<br /> * most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes<br /> <br /> === Acknowledgements ===<br /> <br /> * Zer0Tolerance for the crypto findings<br /> * flatz for his awesome syscon tool<br /> <br /> =Dumping your SC EEPROM=<br /> <br /> ==Linux==<br /> <br /> First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.<br /> <br /> If you are ready.<br /> <br /> Patch DM using linux_hv_scripts<br /> <br /> &lt;pre&gt;<br /> dmpatch.sh<br /> &lt;/pre&gt;<br /> <br /> Read the data from the region you want for example (see tables above)<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy 0x48000 0xFF<br /> &lt;/pre&gt;<br /> <br /> You can see some coolstuff that containing dumps<br /> <br /> =Hashes=<br /> <br /> Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM<br /> <br /> To retrieve the information about the packages you have installed you can also use ps3d_utils<br /> <br /> ==Linux==<br /> <br /> ===Installed Package info===<br /> <br /> &lt;pre&gt;<br /> ps3dm_um /dev/ps3dmproxy get_pkg_info TYPE<br /> &lt;/pre&gt;<br /> <br /> Examples<br /> ----<br /> <br /> get_pkg_info 1 - Core OS package<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt; <br /> <br /> get_pkg_info 2 - Revoke List for program<br /> <br /> &lt;pre&gt; <br /> 0003004100000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 3 - Revoke list for package<br /> <br /> &lt;pre&gt;<br /> 0002003000000000<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 4<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 5<br /> <br /> &lt;pre&gt;<br /> deadbeaffacebabe<br /> &lt;/pre&gt;<br /> <br /> get_pkg_info 6 - Firmware Package<br /> <br /> &lt;pre&gt;<br /> 0003005000000000<br /> &lt;/pre&gt; <br /> <br /> <br /> You can find more information about this in [[Hypervisor Reverse Engineering]] <br /> <br /> <br /> ===Hashes===<br /> <br /> What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).<br /> <br /> &lt;pre&gt;<br /> ps3dm_scm /dev/ps3dmproxy get_region_data ID<br /> &lt;/pre&gt;<br /> <br /> These hashes are checked by lv1 to make sure that the data has not been altered through [[SC_Manager|SC Manager]]: '''scm_get_region_data: get_result: ret[X]: 0x%x'''<br /> <br /> Examples<br /> ----<br /> <br /> <br /> region_data 0 - ROS0<br /> <br /> &lt;pre&gt;<br /> 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb<br /> <br /> --------<br /> &lt;---------------------------lv0---------------------------&gt; &lt;---------------------------lv1---------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 0A AB D0 BE F0 D7 47 7A A7 F4 A7 5B 2D 09 78 48 E9 46 40 62 <br /> &lt;/pre&gt;<br /> <br /> region_data 1 - ROS1<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;----------------------------lv0--------------------------&gt; &lt;--------------------------lv1----------------------------&gt;<br /> 00 03 00 15 00 00 00 00 39 8F 56 3B D3 C3 19 27 42 F5 0B 2A 06 0D 31 64 18 F3 E3 8A 05 D4 15 79 F7 68 8A DF AD 9E CD 34 B4 C7 9F A8 C6 99 82 EE<br /> &lt;/pre&gt;<br /> <br /> region_data 2 - RL_FOR_PROGRAM.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 3 - RL_FOR_PROGRAM.img 1<br /> <br /> &lt;pre&gt; <br /> 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PROGRAM.img--------------------&gt;<br /> 00 03 00 15 00 00 00 00 04 C2 14 37 09 90 C3 3B 24 E0 8C 2C D8 93 14 A5 79 58 90 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 4 - RL_FOR_PACKAGE.img 0<br /> <br /> &lt;pre&gt; <br /> ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 5 - RL_FOR_PACKAGE.img 1<br /> <br /> &lt;pre&gt; <br /> 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> <br /> --------<br /> &lt;-------------------RL_FOR_PACKAGE.img--------------------&gt;<br /> 00 01 00 00 00 00 00 00 33 B2 94 A4 6B E1 49 74 CC 5F EE 48 19 AE 3C 76 CD D2 7D DB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<br /> &lt;/pre&gt;<br /> <br /> region_data 6<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 19 38 98 8F 93 C3 2F A9 C6 51 23 CF 12 CA 69 36 3E 59 7E 41 1F 56 D4 03 F4 C3 D2 6B 5D 51 E4 F4<br /> &lt;/pre&gt;<br /> <br /> region_data 7<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> 00 01 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> &lt;/pre&gt;<br /> <br /> region_data 8 - BD Firmware Package<br /> <br /> &lt;pre&gt; <br /> 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> <br /> --------<br /> <br /> 00 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <br /> &lt;/pre&gt;<br /> <br /> region_data 9<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 5F FB 4E 0B A7 FF 63 F4 F7 0A 22 D4 1B 3D F4 7D 24 32 71 B1 F9 84 B0 CD D7 42 7E FF 0C 77 C7 06<br /> &lt;/pre&gt;<br /> <br /> region_data 10<br /> <br /> &lt;pre&gt; <br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 B9 F1 DA 9F 01 A0 BA A3 3F CE EE 46 41 F6 40 F4 79 10 F6 1C C8 3E F3 55 8D 2C D0 4D 7E FA 27 81<br /> &lt;/pre&gt;<br /> <br /> region_data 11<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 A9 5A 92 EA 64 A6 64 C5 A2 06 93 38 B0 39 45 AD F3 AD 9D FF 90 17 88 26 B1 D3 6A D6 20 A5 73 2D<br /> &lt;/pre&gt;<br /> <br /> region_data 12<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 31 D9 71 84 3D BC 44 B0 2C 7A 64 F3 C6 C2 8C D1 4D 70 8E F0 58 8F 96 2A 82 90 EA D2 F4 1F E6 A9<br /> &lt;/pre&gt;<br /> <br /> region_data 13<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 40 0B 6D 1D FB 4F CE D2 DA 8C B2 E2 27 21 96 27 76 51 CF C8 1E A3 AD ED 7A 8D 9E 9E A7 82 C1 B3<br /> &lt;/pre&gt;<br /> <br /> region_data 14<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 D1 9B DB DA 69 32 00 5E 09 2F D4 8E 22 09 97 03 01 AB 1B D6 0E 19 41 3C 00 B6 2C 40 07 E4 FF 45<br /> &lt;/pre&gt;<br /> <br /> region_data 15<br /> <br /> &lt;pre&gt;<br /> de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be <br /> <br /> --------<br /> <br /> DE AD BE AF FA CE BA BE 00 00 00 00 00 00 00 00 06 71 09 15 89 7E 7D FA B9 38 1A E0 99 CB 02 33 44 9B D6 40 90 AF 01 B9 89 B4 C0 1D 25 AF 4F 84<br /> &lt;/pre&gt;<br /> <br /> region_data 16 - 47?<br /> <br /> = Dumped data =<br /> <br /> Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.<br /> &lt;br&gt;<br /> RETAIL TSOP:<br /> &lt;pre&gt;<br /> 0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ &lt;- version/mode <br /> 0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20 ...l&amp;T.T...qP+. &lt;- vtrm block key<br /> 0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73 3.._w...z.]...Ps &lt;- SRK<br /> 0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5 .E].l..M~....... &lt;- SRK/SRH<br /> 0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... &lt;- SRH<br /> 0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C .....|.PQ..0MQw| <br /> 0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C |....|.PQ..0MQw| <br /> 0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C }....|.PQ..0MQw| <br /> 0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 0<br /> 0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B ...U....P...:O.. &lt;- region data 1<br /> 0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE ....d.....v.\3.. &lt;- region data 1<br /> 0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06 9u..sCi.+..S.J;. &lt;- region data 1<br /> 0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B ...U....{.e... K &lt;- region data 2<br /> 0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF .j...q.'yo...... &lt;- region data 2<br /> 0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 2<br /> 0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 3<br /> 0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47 .........dS.^)G &lt;- region data 4<br /> 0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF ...XJ...P....... &lt;- region data 4<br /> 0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 4<br /> 0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................ &lt;- region data 5<br /> 0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 6<br /> 0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 7<br /> 0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ &lt;- region data 8<br /> 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ &lt;- region data 8<br /> 0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 9<br /> 0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 10<br /> 0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 11<br /> 0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 12<br /> 0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 13<br /> 0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 14<br /> 0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE ................ &lt;- region data 15<br /> 0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C B....|.PQ..0MQw| <br /> 0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C C....|.PQ..0MQw| <br /> 0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C @....|.PQ..0MQw| <br /> 0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C A....|.PQ..0MQw| <br /> 0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C F....|.PQ..0MQw| <br /> 0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C G....|.PQ..0MQw| <br /> 0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C D....|.PQ..0MQw| <br /> 0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C E....|.PQ..0MQw| <br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt; PROTO BGA(DECR):<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54 .I5J..Qz ....R..T<br /> 00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1 ..w..... C....y..<br /> 00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29 .......C 0....n..<br /> 00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00 ..L..D.. ........<br /> 00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d .W.....z ........<br /> 00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71 ..6.H.V. .....I.q<br /> 00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8 ..3..... s.......<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V..... &lt;- this was refurbished<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........ &lt;- this was refurbished<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b &lt;- this was refurbished<br /> 000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0 ...x.... ........<br /> 000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99 T....... H.Km..K.<br /> 000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73 ........ ......is<br /> 000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49 ...U.... ...I...I<br /> 000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff Fe...... E.n.....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7.... &lt;- this was refurbished<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q.... &lt;- this was refurbished<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc ........ ..2.L.Y.<br /> 00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff ...vw... ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It &lt;- this was refurbished<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........ &lt;- this was refurbished<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........ &lt;- this was refurbished<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25 ....U..D ..wQ....<br /> 000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54 ....Cy.. Y......T<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96 ....I.q. .X....0.<br /> 00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87 Y....b.. .og.....<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04 ...1.... ...8....<br /> 00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8 .V..o.5. ...R.NM.<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8 ....B... X.......<br /> 000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa ..T....F ..C.....<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38 .n.7U.z. bS.....8<br /> 000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6 5....... ....O.A.<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9 ...x.... ......4.<br /> 00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48 ........ .....c.H<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b .O...... ....NH..<br /> 00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49 ..Z..E.E .......I<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63 ......6. .O...s.c<br /> 00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5 ...W.Dp. j.......<br /> 00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8 I..tEuf. .tKfX.B.<br /> 00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32 .q...U.d ..OG.a12<br /> 000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71 P...dz.. .....Seq<br /> 000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82 ..t...H. ..QtB.7.<br /> 000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38 x....dqI .eh..y.8<br /> 000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4 o..m.X.. .C.I....<br /> 000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47 ..H..... n.zu...G<br /> 000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe ....CSJe ...I....<br /> &lt;/pre&gt;<br /> <br /> &lt;pre&gt;<br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5 .h...W.. .....I..<br /> 00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af ........ .I.Fl...<br /> 00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18 t....... i..Z.6..<br /> 00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00 .R...YB. ........<br /> 00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a .......w ........<br /> 00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e ..A..... ........<br /> 00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc ..a..A.. .P..Y.Q.<br /> 00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be B.....1d ........<br /> 000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62 ..Gz.... ..xH.F.b<br /> 000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27 ........ 9.V.....<br /> 000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79 B.....1d .......y<br /> 000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee .h.....4 ........<br /> 000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b ........ ...7....<br /> 00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff ........ yX.Q....<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74 ........ 3...k.It<br /> 00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff ...H...v ........<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36 .8...... .Q....i6<br /> 000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4 .Y.A.V.. ...k.Q..<br /> 000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d ..N...c. ........<br /> 00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06 .2q..... .B...w..<br /> 00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4 ........ ...FA...<br /> 00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81 y......U ...M....<br /> 00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad .Z..d.d. ...8.9E.<br /> 000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d ........ ..j...s.<br /> 000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1 1.q...D. .zd.....<br /> 000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9 Mp..X... ........<br /> 000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27 ..m..O.. ........<br /> 00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3 vQ...... z.......<br /> 00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03 ....i2.. ........<br /> 00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45 ......A. .......E<br /> 00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33 .q...... .8.....3<br /> 00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84 D....... ......O.<br /> 00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e .....Y.. C.1....N<br /> 00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af A..x.O.. .q....O.<br /> 000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc C....lM. ...B.G..<br /> 000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41 T....W.. 4.v....A<br /> 000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23 ........ ..D.j.8.<br /> 000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23 ..S...4. .d..n.N.<br /> 000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2 k....r.. .....B..<br /> 000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39 .wl..... ....E..9<br /> &lt;/pre&gt;<br /> <br /> &lt;br&gt;<br /> <br /> RETAIL BGA:<br /> <br /> &lt;pre&gt;<br /> <br /> 00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d 7..p1.dH ....7o..<br /> 00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1 1.b..V.. .j.e.6..<br /> 00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97 Ta...X.. ........<br /> 00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00 ...UN... ........<br /> 00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61 .....X.. ..z...ua<br /> 00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a ....5.Z. .......j<br /> 00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e t......c a.......<br /> 00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22 ...U.... f..R....<br /> 000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89 ...8...4 .v.B....<br /> 000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd ......Mw ........<br /> 000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b ...U.... ..e....K<br /> 000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff .j...q.. yo......<br /> 00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47 ........ .dS....G<br /> 00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff ...XJ... P.......<br /> 00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff ........ ........<br /> 000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ........ ........<br /> 00000230: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000240: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000250: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000260: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000270: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000280: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000290: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000300: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000310: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000320: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000330: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000340: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000350: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000360: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000370: de ad be af fa ce ba be - de ad be af fa ce ba be ........ ........<br /> 00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b .x...... .c....2.<br /> 00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90 e0..1.T. .B...Rj.<br /> 000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94 ..ADf.O. .c......<br /> 000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31 .....CI. .M.....1<br /> 000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4 .7...... ..to....<br /> 000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee .D.g.... r....v..<br /> 000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00 R..R..Lr ...L..8.<br /> 000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23 ........ ......r.<br /> &lt;/pre&gt;<br /> <br /> == More samples ==<br /> <br /> * https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin<br /> <br /> =Tokens=<br /> <br /> Here we will document the different types off tokens known in the PS3<br /> All tokens are tied? encrypted? using EID0.<br /> They enable additional repository nodes.<br /> <br /> ==List==<br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Token !! Location !! Size !! SPU module !!Description<br /> |-<br /> | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || <br /> |-<br /> | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed<br /> |-<br /> | token_seed || ? || ? || ? || This is used to create the token with EID0<br /> |}<br /> <br /> ==Token Seed==<br /> <br /> Unencrypted form of QA-token<br /> <br /> ==Structure==<br /> <br /> This section has to be corrected, is only based on debug strings, we need to decrypt the tokens<br /> <br /> ===Token Seed===<br /> <br /> ?<br /> <br /> ===QA Token===<br /> <br /> <br /> <br /> ===User Token===<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || m_magic<br /> |-<br /> | ? || ? || m_format_version<br /> |-<br /> | ? || ? || m_size<br /> |-<br /> | ? || ? || m_capability<br /> |-<br /> | ? || ? || m_expire_date<br /> |-<br /> | ? || ? || m_idps?<br /> |-<br /> | ? || ? || m_attribute<br /> |-<br /> | ? || ? || m_digest<br /> |}<br /> <br /> For every atribute in the token<br /> <br /> {| class=&quot;wikitable FCK__ShowTableBorders&quot;<br /> |-<br /> ! Address !! Size !! Description<br /> |-<br /> | ? || ? || attr:m_type<br /> |-<br /> | ? || ? || attr:m_size<br /> |-<br /> | ? || ? || attr:m_data<br /> |}<br /> <br /> = Dumping SC EEPROM - hardware way =<br /> <br /> {| border=&quot;1&quot; cellspacing=&quot;0&quot; cellpadding=&quot;5&quot; border=&quot;#999&quot; class=&quot;wikitable&quot; style=&quot;border:1px solid #999; border-collapse: collapse;&quot; <br /> |-<br /> ! style=&quot;background-color:red;&quot; | &lt;span style=&quot;background-color:lightred; color:white; font-size:200%; &quot;&gt;Warning&lt;/span&gt;<br /> |-<br /> | style=&quot;background-color:white;&quot; | &lt;span style=&quot;white; color:red; font-size:150%; text-align:center; &quot;&gt;You can use this method at your own risk. Author is not responsible for any hardware damages and failures. <br /> |}<br /> == Bus Pirate 3 Solderless method ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)<br /> <br /> 2) Bus Pirate v3.6 with connectors.<br /> <br /> 3) Wires (I used AWG32 150mm with tinned ends, see below)<br /> <br /> 4) PC with OS Windows7 (Should work on other windows systems, but not tested).<br /> <br /> 5) A sharp pencil.<br /> <br /> 6) Fingers ;)<br /> <br /> === Hardware Part ===<br /> <br /> Find the syscon on your PS3 motherboard.<br /> [[File:CXR713120 on SEM-001.JPG|thumbnail|none]]<br /> <br /> Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.<br /> [[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]<br /> <br /> Draw the Pinout for convenience.<br /> [[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]<br /> <br /> Connect Bus-Pirate and AWG32 wires using probe Kit<br /> [[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]<br /> <br /> Connect Bus-Pirate to the EEPROM Pins using the folowing table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! EEPROM pin<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.<br /> [[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]<br /> Connect Bus-Pirate to you PC with Windows7 by USB.<br /> <br /> === Software Part ===<br /> <br /> Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!<br /> <br /> Download and Install the driver for Bus-Pirate.<br /> <br /> Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe<br /> <br /> Open the Device Manager and find the port number of your USB Serial Port.<br /> [[File:USB Serial Port.jpg|thumbnail|none]]<br /> <br /> Download and Run Syscon Flasher.exe<br /> <br /> Download link: https://www.sendspace.com/file/7jq6ka<br /> <br /> MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1<br /> <br /> [[File:Syscon Flasher GUI.jpg|thumbnail|none]]<br /> <br /> There are 6 simple steps to obtain the dump.<br /> <br /> 1) Select the correct USB Serial Port for Bus-Pirate.<br /> <br /> 2) Press &quot;Send settings to device&quot; button. If done correctly, then &quot;Mode&quot; Led on the Bus Pirate will be Green.<br /> <br /> 3) Press &quot;Power on&quot; button. If done correctly, then &quot;VREG&quot; Led on the Bus Pirate will be Red.<br /> <br /> 4) Press &quot;Browse&quot; button and specify location and file name for your syscon eeprom dump.<br /> <br /> 5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.<br /> <br /> 6) Press &quot;Fast Read&quot; button and wait about 15sec.<br /> <br /> Enjoy:<br /> <br /> My dump, for example:<br /> <br /> https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ<br /> <br /> == Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.<br /> <br /> 2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.<br /> <br /> 3) Soldering station.<br /> <br /> 4) Wires (see below).<br /> <br /> 5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++<br /> <br /> 6) /dev/Hands ;)<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture. (for DIA-001 Users)<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> <br /> or this one, if you own a DECR-1400<br /> <br /> [[File:DEB-001 SC EEPROM.png|thumbnail|none]]<br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Bus Pirate to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Bus Pirate pin !! Test Point<br /> |-<br /> | CLK || SKB<br /> |-<br /> | CS || CSB<br /> |-<br /> | MOSI || DI<br /> |-<br /> | MISO || DO<br /> |-<br /> | 3V3 || WCB, RBB<br /> |-<br /> | GND || Any Ground Point<br /> |}<br /> <br /> Make sure that the battery is attached to the motherboard.<br /> <br /> Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)<br /> <br /> It should be done like this, see the following picture:<br /> <br /> [[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]<br /> <br /> === Setup software ===<br /> <br /> 1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Parameter !! Value<br /> |-<br /> | Bits per second || 115200<br /> |-<br /> | Data bits || 8<br /> |-<br /> | Parity || None<br /> |-<br /> | Stop bits || 1<br /> |-<br /> | Flow control || None<br /> |}<br /> <br /> Open Putty and set it up:<br /> <br /> session params:<br /> <br /> connection type: Serial<br /> <br /> Serial line: COM3 (choose your virtual COM port)<br /> <br /> Speed (baud rate): 115200<br /> <br /> Logging params:<br /> <br /> Session logging: All session output<br /> <br /> Log file name: click Browse button and specify your logfile, for example: C:\PS3\Logs\logfile.log<br /> <br /> Now click Open button and setup mode for bus pirate using following commands:<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Command !! Description<br /> |-<br /> | m || (mode)<br /> |-<br /> | 5 || (SPI)<br /> |-<br /> | 4 || (Set speed: 1MHz)<br /> |-<br /> | 2 || (Clock polarity: Idle high)<br /> |-<br /> | 1 || (Output clock edge: Idle to active<br /> |-<br /> | 1 || (Input sample phase: Middle *default)<br /> |-<br /> | 2 || (CS: /CS)<br /> |-<br /> | 2 || (Select output type: Normal (H=3.3V, L=GND))<br /> |}<br /> <br /> Enable 3.3V: Just type: W (big leter) and press Enter.<br /> <br /> === Obtain the dump ===<br /> <br /> Type: [0xa8 0x00 0x00 r:32768] and press Enter.<br /> <br /> Wait until dumping process will be completed and close Putty.<br /> <br /> Thats all. The dump must be into your logfile.log<br /> <br /> You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.<br /> <br /> &lt;small&gt;Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000), [r:] are syntax command of the Bus Pirate for start, read byte and end&lt;/small&gt;<br /> <br /> == Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) == <br /> <br /> I had build my own Syscon EEPROM flasher based on open source hardware &quot;'''Arduino Mega'''&quot; and some resistors.<br /> This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).<br /> <br /> === You need ===<br /> 1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.<br /> <br /> 2) Arduino Mega or any Arduino board.<br /> <br /> 3) 6 x 3.6 KOHM resistors + 6 x 1.8 KOHM resistors (work together as a voltage dividers since Arduino IO logic is 5.0v and Syscon EEPROM IO Logic is 3.3v).<br /> <br /> 4) Soldering station.<br /> <br /> 5) Wires &amp; Bread board (Optional).<br /> <br /> 6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.<br /> <br /> === Preparation ===<br /> <br /> Find the test points on the motherboard using this picture.<br /> [[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]<br /> Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly. <br /> <br /> All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.<br /> <br /> Attach a Arduino Mega to the wires using the following table:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Arduino Mega pin !! Test Point !! Syscon Pin<br /> |-<br /> | SCL (52) || SKB || E16<br /> |-<br /> | SS (53) || CSB || F16<br /> |-<br /> | MOSI (51) || DI || G16<br /> |-<br /> | MISO (50) || DO || H16<br /> |-<br /> | WP (48) || WCB || J15<br /> |-<br /> | RB (49) || RBB || J16<br /> |-<br /> | VCC (3.3v) || Not needed if you used battery power || G11<br /> |-<br /> | GND || Any Ground Point || C15<br /> |}<br /> <br /> *Make sure that the battery is attached to the motherboard if you will dump/flash SysCon EEPROM in board.<br /> <br /> *Make sure the pins are compatible or edited if using other arduino Board.<br /> <br /> **Arduino Mega: MISO is 50, MOSI is 51, SCK is 52 and SS is usually 53<br /> **Arduino Leonardo: the SPI pins are on the ICSP header pins.<br /> **Arduino Duemilanove/Uno: SS is digital 10, MOSI is 11, MISO is 12, SCK is (usually) 13<br /> <br /> === Wiring Diagram &amp; Photos ===<br /> <br /> [[File:PS3 SysCon EEPROM Flasher.jpg|thumbnail|none|PS3 SysCon EEPROM Flasher]]<br /> [[File:Fat SysCon Desoldered And Attached To Arduino.jpg|thumbnail|none|Fat SysCon Desoldered And Attached To Arduino]]<br /> [[File:SysCon EEPROM Dumping Process.jpg|thumbnail|none|SysCon EEPROM Dumping Process]]<br /> <br /> === Arduino Sketch Source Code ===<br /> Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.<br /> http://pastie.org/10004682#8,19<br /> <br /> <br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=3.55_DECR&diff=49737 3.55 DECR 2018-06-29T14:16:16Z <p>93.108.187.41: /* Changes */</p> <hr /> <div>= Changes =<br /> PS3DECRUpdateData.355.001d Jan 27 2011 141808 KB<br /> <br /> * System Debugger Features have been removed<br /> <br /> = Download =<br /> * http://yadi.sk/d/i567KQyJ3oqIN<br /> * &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://www.multiupload.com/IUVA4T7UVA&lt;/span&gt;<br /> * &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://www.ps3devwiki.com/files/firmware/OFW-DECR/3.55/PS3UPDAT.PUP&lt;/span&gt;<br /> <br /> = PUP Hashes =<br /> MD5::9085da7157e92fa59157676a429a7c1e | SHA1::b9a9a7cf2fbdbc836d05ece0b19e2e5b5c5a3457 | CRC32::B20A77B4 | CRC16::5996 | HMAC_SHA1::C36454DAD84EB490B1E85436F6A61B743AE32684<br /> <br /> = PUP Information =<br /> &lt;pre&gt;PUP file information<br /> Package version: 1<br /> Image version: 99999<br /> File count: 8<br /> Header length: 592<br /> Data length: 145209856<br /> PUP file hash : C36454DAD84EB490B1E85436F6A61B743AE32684<br /> File 0<br /> Entry id: 0x100<br /> Filename : version.txt<br /> Data offset: 0x250<br /> Data length: 5<br /> File hash : 0E460E25AAC0687D3AFCBD8C0C9363FFB9687514<br /> File 1<br /> Entry id: 0x101<br /> Filename : license.xml<br /> Data offset: 0x255<br /> Data length: 3<br /> File hash : 1AA4749D0EE0D0AE937FBF73BC4B9ACD352F732A<br /> File 2<br /> Entry id: 0x200<br /> Filename : ps3swu.self<br /> Data offset: 0x258<br /> Data length: 5661688<br /> File hash : 76CAE611D95399B0E7FD21AC469A0FEEE8FD4600<br /> File 3<br /> Entry id: 0x201<br /> Filename : vsh.tar<br /> Data offset: 0x566650<br /> Data length: 10240<br /> File hash : D9B66E0D2845D71A67D76E7907AB06368CE61E08<br /> File 4<br /> Entry id: 0x202<br /> Filename : dots.txt<br /> Data offset: 0x568E50<br /> Data length: 0<br /> File hash : B701CBBD3ACE82CAF2E4018E5327AA16637490DE<br /> File 5<br /> Entry id: 0x300<br /> Filename : update_files.tar<br /> Data offset: 0x568E50<br /> Data length: 133836800<br /> File hash : CF61B9C46DF471FAF27A4343E293450E79B0CABD<br /> File 6<br /> Entry id: 0x501<br /> Filename : spkg_hdr.tar<br /> Data offset: 0x850BE50<br /> Data length: 40960<br /> File hash : B22C9A3069906F0B6A0F320171939D236E338B3C<br /> File 7<br /> Entry id: 0x601<br /> Filename : ps3swu2.self<br /> Data offset: 0x8515E50<br /> Data length: 5660160<br /> File hash : 5595648CF3648ED1F20BD820B5452E561D19891E<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> {{System Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Syscon_Hardware&diff=48578 Syscon Hardware 2018-03-31T13:23:08Z <p>93.108.187.41: /* Packets Logs */</p> <hr /> <div>&lt;div style=&quot;float:right&quot;&gt;[[File:SYSCON_GEN1.JPG|thumb|Syscon 1st Generation (BGA Packaging)]]&lt;br /&gt;[[File:Pyramid Syscon live probing.jpg|thumb|Pyramid Syscon live probing]]&lt;/div&gt;<br /> <br /> Syscon is the main power controller chip. It is responsible for powering up the various power systems and for configuring and initialising the [[CELL BE]], [[RSX]] and [[South Bridge]]. It communicates with these devices via seperate SPI busses. There is external access by JTAG (disabled from factory on retail models), an EEPROM programming interface &lt;!-- not fully examined --&gt; and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM.<br /> <br /> = Serialnumbers @ SKU =<br /> <br /> == Retail ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon&lt;br /&gt;part no.]] !! Syscon&lt;br /&gt;[[More System Information#First_section|Soft ID]] !! Notes<br /> |-<br /> | [[CECHAxx]]&lt;br /&gt;[[CECHBxx]] || 0x01&lt;br /&gt;0x02 || [[COK-00x#COK-001|COK-001]] || [[CXR713120-201GB]] || 0B8E || <br /> |-<br /> | [[CECHCxx]]&lt;br /&gt;[[CECHExx]] || 0x03&lt;br /&gt;0x04 || [[COK-00x#COK-002|COK-002]] or&lt;br /&gt;[[COK-00x#COK-002W|COK-002W]] || [[CXR713120-201GB]] or&lt;br /&gt;[[CXR713120-202GB]] || 0C16 || <br /> |-<br /> | [[CECHGxx]] || 0x05 || [[SEM-00x|SEM-001]] || [[CXR713120-201GB]] or&lt;br /&gt;[[CXR713120-202GB]] or&lt;br /&gt;[[CXR713120-203GB]] || 0D52 ||<br /> |-<br /> | [[CECHHxx]] || 0x06 || [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]] || 0DBF ||<br /> |-<br /> | [[CECHJxx]]&lt;br /&gt;[[CECHKxx]] || 0x07 || [[DIA-00x#DIA-002|DIA-002]] || [[CXR714120-301GB]] or&lt;br /&gt;[[CXR714120-302GB]] || 0E69 || <br /> |-<br /> | [[CECHLxx]]&lt;br /&gt;[[CECHMxx]]&lt;br /&gt;[[CECHPxx]]&lt;br /&gt;[[CECHQxx]] || 0x08 || [[VER-00x|VER-001]] || [[SW-301]] or&lt;br /&gt;[[SW-302]] || 065D ||<br /> |-<br /> | [[CECH-20xx]] || 0x09 || [[DYN-00x|DYN-001]] || [[SW2-301]] || 0832 || <br /> |-<br /> | [[CECH-21xx]] || 0x0A || [[SUR-00x|SUR-001]] || [[SW2-301]] or&lt;br /&gt;[[SW2-302]] || 08A0 || <br /> |-<br /> | [[CECH-25xx]] || 0x0B || [[JTP-00x|JTP-001]] or&lt;br /&gt;[[JSD-00x|JSD-001]] || [[SW2-301]] or&lt;br /&gt;[[SW2-302]]&amp;nbsp;&amp;nbsp;or&lt;br /&gt;[[SW2-303]] || 08C2 || <br /> |-<br /> | [[CECH-30xx]] || 0x0C || [[KTE-00x|KTE-001]] || [[SW2-301]] or&lt;br /&gt;[[SW2-302]] or&lt;br /&gt;[[SW2-303]] || 0918 || <br /> |-<br /> | [[CECH-40xx]] || 0x0D || [[MSX-00x|MSX-001]] or&lt;br /&gt;[[MPX-00x|MPX-001]] || [[SW3-302]] || 098F || <br /> |-<br /> |}<br /> <br /> ==Non retail==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon&lt;br /&gt;part no.]] !! Syscon&lt;br /&gt;[[More System Information#First_section|Soft ID]] !! Active JTAG !! Notes<br /> |-<br /> | [[CEB-2040]] || - || [[MPU-501]] || [[CXR713F120|CXR713F120GB-000]] || ? || Yes || Retail prototype<br /> |-<br /> | [[DECR-1000|DECR1000(A/J)]] || 0x01 || [[TMU-520]] || [[CXR713F120A]] || 03FB || Yes || Reference tool<br /> |-<br /> | [[DEH-H1001-D]] || 0x01 || [[COOKIE-13]] || [[CXR713F120A]] || 0B67 || Yes || Preproduction<br /> |-<br /> | [[DEH-H1000A(S)(-E(S))]] || 0x01 || [[COK-001 (Prototype)]] || [[CXR713F120A]] || 0B67 || Yes || Preproduction<br /> |-<br /> | [[DEH-FH1500J-A]] || 0x08 || [[VERTIGO-02]] || D79F0073 ([[SW-301]]) || 0658 || ?Yes? || Preproduction<br /> |-<br /> | [[DEH-ML00AK-G]] || 0x0D || [[MPX-001 (Prototype) ]] || D79F0123 ([[SW3-302]]) || 098F || ?No? || Preproduction<br /> |-<br /> &lt;!-- Not Prototype debug units - see retail --&gt;<br /> |}<br /> &lt;br/&gt;<br /> ----<br /> <br /> Not mentioned:&lt;pre&gt;<br /> 0F29 - ?<br /> 0F38 - ?&lt;/pre&gt;<br /> <br /> = Syscon Externalised Ports =<br /> '''Note:''' for more specific information per model, see the links to each subppage in the Serialnumbers @ SKU table.<br /> <br /> == Syscon UART packets ==<br /> <br /> === SCUART daemon (SCUARTD) packet structure ===<br /> <br /> SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command).<br /> Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses.<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Offset !! Size !! Description<br /> |-<br /> | 0x00 || 0x01 || Magic?<br /> |-<br /> | 0x01 || 0x01 || Payload size<br /> |-<br /> | 0x02 || 0x01 || Command<br /> |-<br /> | 0x03 || Payload size || Payload data<br /> |-<br /> |}<br /> <br /> === Packets ===<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Packet ID !! Command/Action !! Description !! Notes<br /> |-<br /> | 0x00 || '''version''' || Firmware version || Gets installed syscon's firmware version (Note: backup bank contains version 0.4.5_b4 !! On CEB-2030 it is 0.3.0 )<br /> |-<br /> | 0x01 || '''bringup''' || || &lt;!--// Standby-&gt;ON (Remote Power ON using an UART package, from [[Communication Processor]] ?) //--&gt;<br /> |-<br /> | 0x02 || '''shutdown''' || || &lt;!--// ON-&gt;Standby (Remote Power OFF using an UART package, from [[Communication Processor]] ?) //--&gt;<br /> |-<br /> | 0x03 || '''firmud''' || Firmware update || Notifies about firmware update operation<br /> |-<br /> | 0x04 || '''bsn''' || Board Serial Number || Retrieves syscon's Board Serial Number<br /> |-<br /> | 0x05 || '''halt''' || || Used at start of firmware update operation<br /> |-<br /> | 0x06 || '''cp ready''' || || &lt;!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //--&gt;<br /> |-<br /> | 0x07 || '''cp busy''' || || &lt;!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //--&gt;<br /> |-<br /> | 0x08 || '''cp reset''' || || &lt;!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //--&gt;<br /> |-<br /> | 0x09 || '''bestat''' || Cell B.E. status || Retrieves Cell B.E. status<br /> |-<br /> | 0x0A || '''powersw''' || &lt;!-- Power switch ? --&gt; ||<br /> |-<br /> | 0x0B || '''resetsw''' || &lt;!-- Reset switch ? --&gt; ||<br /> |-<br /> | 0x0C || '''bootbeep stat''' || ||<br /> |-<br /> | 0x0D || '''bootbeep on''' || ||<br /> |-<br /> | 0x0E || '''bootbeep off''' || ||<br /> |-<br /> | 0x0F || ''Reset syscon'' || Reset || Resets syscon<br /> |-<br /> | 0x10 || '''xdrdiag info''' || XDR diagnostics ||<br /> |-<br /> | 0x11 || '''xdrdiag start''' || XDR diagnostics || Starts XDR diagnostics<br /> |-<br /> | 0x12 || '''xdrdiag result''' || XDR diagnostics || Gets a result of XDR diagnostics<br /> |-<br /> | 0x13 || '''xiodiag''' || XIO diagnostics || Starts XIO diagnostics and gets a result of it<br /> |-<br /> | 0x14 || '''fandiag''' || Fan diagnostics || Retrieves RPMs of fans<br /> |-<br /> | 0x15 || '''errlog''' || Error log || Retrieves a list of codes (with timestamps) of latest errors<br /> |-<br /> | 0x16 || ''Read line'' || ||<br /> |-<br /> | 0x17 || '''tmpforcp &lt;zone ID&gt;''' || Reference Tool's temperature || Gets the temperature of reference tool<br /> |-<br /> | 0x18 || rowspan=&quot;7&quot; colspan=&quot;3&quot; style=&quot;background:lightgrey; color:#ff0000; text-align: center;&quot; | Invalid CMDs<br /> |-<br /> | 0x19<br /> |-<br /> | 0x1A<br /> |-<br /> | 0x1B<br /> |-<br /> | 0x1C<br /> |-<br /> | 0x1E<br /> |-<br /> | 0x1F<br /> |-<br /> | 0x20 || '''cp beepremote''' || ||<br /> |-<br /> | 0x21 || '''cp beep2kn1n3''' || ||<br /> |-<br /> | 0x22 || '''cp beep2kn2n3''' || ||<br /> |-<br /> | ?? || '''csum''' || Checksum ?? || Calculates the Checksum of something (No packet ID listing on scuartd)<br /> |-<br /> | ?? || '''osbo''' || ??? || No idea what this does, but returns &lt;pre&gt;done&lt;/pre&gt; when it's sent &lt;!--Operative System Boot Order ?... something related with gameOS/otherOS boot flag ? --&gt;<br /> |-<br /> | ?? || '''scopen''' || returns SC_READY or ERROR 1 || ???<br /> |-<br /> | ?? || '''scclose''' || || ???<br /> |-<br /> |}<br /> <br /> === Packets Logs ===<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Packet ID !! Command/Action !! Logs !! Notes<br /> |-<br /> | 0x00 || '''version''' || &lt;pre&gt; version\nv1.0.4_c2\n (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x01 || '''bringup''' || &lt;pre&gt; (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x02 || '''shutdown''' || &lt;pre&gt; Do nothing. (PowerOff State)\n (END) &lt;/pre&gt; || Returns (END) if the system is on <br /> |-<br /> | 0x03 || '''firmud''' || &lt;pre&gt; Start...\nErase User Program Area\n (END) &lt;/pre&gt; || This will brick your SYSCON if you don't feed it any argument or feed to it the wrong argument!<br /> |-<br /> | 0x04 || '''bsn''' || &lt;pre&gt; bsn\nNANNNNNNNNNA\n (END) &lt;/pre&gt; || N is digit and A is char (removed for privacy)<br /> |-<br /> | 0x05 || '''halt''' || &lt;pre&gt; halt\n (END)&lt;/pre&gt; ||<br /> |-<br /> | 0x06 || '''cp ready''' || &lt;pre&gt; cp ready\nCP READY: OK\n (END) &lt;/pre&gt; || <br /> |-<br /> | 0x07 || '''cp busy''' || &lt;pre&gt; cp ready\nCP BUSY: OK\n (END) &lt;/pre&gt; || STATUS light blinks forever<br /> |-<br /> | 0x08 || '''cp reset''' || No response || Should reset CP to factory settings<br /> |-<br /> | 0x09 || '''bestat''' || &lt;pre&gt; (PowerOff State)\n (END) &lt;/pre&gt;||<br /> |-<br /> | 0x0A || '''powersw''' || &lt;pre&gt; (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x0B || '''resetsw''' || &lt;pre&gt; (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x0C || '''bootbeep stat''' || &lt;pre&gt; BOOT BEEP: ON\n (END) &lt;/pre&gt; || when it's off BOOT BEEP status changes to OFF<br /> |-<br /> | 0x0D || '''bootbeep on''' || &lt;pre&gt; BOOT BEEP ON: DONE\n (END) &lt;/pre&gt; || <br /> |-<br /> | 0x0E || '''bootbeep off''' || &lt;pre&gt; BOOT BEEP OFF: DONE\n (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x0F || '''Reset syscon''' || ||<br /> |-<br /> | 0x10 || '''xdrdiag info''' || &lt;pre&gt; 32\n (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x11 || '''xdrdiag start''' || &lt;pre&gt; DIAG START\n (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x12 || '''xdrdiag result''' || &lt;pre&gt; XDR OK\n (END) &lt;/pre&gt; || will return ERROR NOT STARTED if xdrdiag start wasn't run previously<br /> |-<br /> | 0x13 || '''xiodiag''' || &lt;pre&gt; 0 903\n (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x14 || '''fandiag''' || &lt;pre&gt; ERROR FAN ACTIVE\n (END) &lt;/pre&gt; ||<br /> |-<br /> | 0x15 || '''errlog''' || &lt;pre&gt; ofst[ %d]:err_code:0x%08X, clock:0x%08X YYYY/MM/DD HH:MM:SS &lt;/pre&gt; || bunch of error logs. ends with (END) once they're over<br /> |-<br /> | 0x16 || '''Read line''' || ||<br /> |-<br /> | 0x17 || '''tmpforcp &lt;zone ID&gt;''' || <br /> |-<br /> | 0x20 || '''cp beepremote''' || &lt;pre&gt; (END)&lt;/pre&gt; ||<br /> |-<br /> | 0x21 || '''cp beep2kn1n3''' || &lt;pre&gt; (END)&lt;/pre&gt; || sends a beep different than SYSCON beep :)<br /> |-<br /> | 0x22 || '''cp beep2kn2n3''' || &lt;pre&gt; (END)&lt;/pre&gt; || sends two beeps different than SYSCON beeps :)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [027460C9] [68269779] [C19A855E]\n (END)&lt;/pre&gt; || displays 3 hexadecimal numbers inside rect parenthesis. the numbers are always the same, except when syscon version changes (v1.0.5_c1) <br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [02746F91] [682F04DA] [27688CF5]\n (END)&lt;/pre&gt; || Another response (v1.0.4_c2)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [0274C877] [684DA659] [EA426BB1]\n (END)&lt;/pre&gt; || Another response (v1.0.4_c1)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [027B4064] [6B450C64] [4FBF6DA3]\n (END)&lt;/pre&gt; || Another response (v1.0.3_c1)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [027E1B71] [6CDA9F25] [E0C67065]\n (END)&lt;/pre&gt; || Another response (v1.0.1_c1)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [02812855] [6E83917C] [D40F70A5]\n (END)&lt;/pre&gt; || Another response (v0.9.14_c1)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [02835059] [6FC5C632] [BB9BBEC3]\n (END)&lt;/pre&gt; || Another response (v0.9.9_c1)<br /> |-<br /> | ?? || '''csum''' || &lt;pre&gt;Checksum: [026F7951] [66CB09FF] [4EA06B56]\n (END)&lt;/pre&gt; || Another response (v0.8.4_c8)<br /> |-<br /> | ?? || '''osbo''' || &lt;pre&gt;done\n (END)&lt;/pre&gt; ||<br /> |-<br /> |}<br /> <br /> === Notes ===<br /> <br /> * Some commands are unavailable on earlier firmwares, for example, tmpforcp is only supported on 1.3.3+.<br /> * Some commands are divided into several strings, the first part (if exists) describes a command group, the second part describes the actual command and other parts describes command arguments.<br /> * Real syscon commands have an ASCII form (a bold text in the 2nd column) instead of bytes above.<br /> * Packet with ID *0x03* notifies syscon and calls SX program (based on ZMODEM protocol) to send firmware, syscon have custom or original implementation of RX program to receive firmware. An implementation of ZMODEM protocol used by Sony: http://oss.sony.net/Products/Linux/Others/Download/DECR-1000/mips_fp_le-lrzsz-0.12.20-devtool.1.src.rpm<br /> <br /> A start of syscon's update procedure:<br /> * A CP development tool includes several scripts which are participated in syscon update procedure. It starts after a CP update via ''update_syscon.pl'' perl script.<br /> * This script checks the current syscon's firmware version. If it is in mask rom then it skips an update procedure, if not it checks major/minor/release parts of both versions and if a new version is applicable then it launches ''scfirmup'' utility and pass the firmware file path as an argument.<br /> * ''scfirmup'' is a stupid tool which prepares a connection to SCUARTD and sends an update packet with a file path inside it. There is no need to comment it, here is reimplementation: http://pastie.org/private/6h8mfeoics4mdxear7ayg<br /> <br /> A syscon's update operation in '''SCUARTD''' consists of following steps:<br /> * 1. Check if ''SX'' program presents in ''/usr/bin/sx''. It should be a regular file.<br /> * 2. Check if specified firmware file is a regular file.<br /> * 3. Halt syscon by sending command '''halt''' to UART, then wait some time until it prints ''HALT: OK''.<br /> * 4. Reset syscon by sending byte ''0x30'' to GPIO register '''SC_PI0_DIPSW''', byte ''0x30'' to GPIO register '''SC_RSTX''', waiting 1 second and writing byte ''0x31'' to GPIO register '''SC_RSTX'''.<br /> * 5. Get current syscon's firmwave version by sending command '''version''' to UART. After receiving it, look for a character after the first ''_'' (underscore) symbol from the left side of string and if it equals to the character ''b'', then proceed to the next step, otherwise go to the (8) step. (It is possible to patch this step to allow upgrading or downgrading at will)<br /> * 6. Prepare syscon for an update by sending command '''firmud''' to UART, then fork the current process; the current process won't finish until a message ''Done'' from UART arrives (it is the end of update operation).<br /> * 7. In the forked process start ''SX'' program and pass firmware file path to it. ''SX'' program reads firmware file and transfer each chunk of it to syscon.<br /> * 8. After successful update operation reset syscon (a different way) by sending byte ''0x31'' to GPIO register '''SC_PI0_DIPSW''', byte ''0x30'' to GPIO register '''SC_RSTX''', waiting 1 second and writing byte ''0x31'' to GPIO register '''SC_RSTX'''.<br /> <br /> Notes:<br /> * It seems all scuartds checks firmware revision and probably syscon is updated only once (after factory).<br /> * To be able to reflash it you need to patch ''SCUARTD'' or do a manual update without the use of ''SCUARTD''.<br /> * You need to patch a single byte in ''SCUARTD'' to be able to flash any firmware (for example, to downgrade your syscon).<br /> &lt;syntaxhighlight lang=&quot;asm&quot;&gt;<br /> .text:00403A94: /* scuartd from CP 1.3.3 */<br /> lb $v1, 1($v0)<br /> li $v0, &quot;b&quot; /* 62 00 02 24 -&gt; 63 00 02 24 */<br /> bne $v1, $v0, loc_4039F4<br /> move $a0, $zero<br /> &lt;/syntaxhighlight&gt;<br /> * An actual firmware update process (without halting and resetting steps) takes about 1 minute.<br /> * You cannot install a corrupted firmware with scfirmup unless you corrupt the header! It seems there is a hash of sorts (possibly of the plaintext) in the header preventing scfirmup from installing something corrupt<br /> * Updating SYSCON requires the DECR to be in standby mode! You cannot update it while it is on.<br /> * Corrupting the header and the body will make firmup install the SYSCON update anyways! be careful not to do it!<br /> * Should you brick SYSCON, here's a patch to &quot;unbrick&quot; it, do not use it unless you brick it though!<br /> &lt;syntaxhighlight lang=&quot;asm&quot;&gt;<br /> .text:004038C0:<br /> lw $a0, 4($s4)<br /> li $a1, 0x400000<br /> nop<br /> addiu $a1, (aHalt - 0x400000) # &quot;halt&quot;<br /> la $t9, scuartd_send_sccmd<br /> nop<br /> jalr $t9 ; scuartd_send_sccmd<br /> nop<br /> lw $gp, 0x1E8+var_1D8($sp)<br /> bnez $v0, loc_4039B4 /* 33 00 40 14 -&gt; 33 00 40 10 */<br /> li $a0, 1<br /> &lt;/syntaxhighlight&gt;<br /> <br /> * You can use this bruteforcer to try your luck when finding new packets : https://hastebin.com/vomogesaru.cpp<br /> <br /> == Syscon UART ==<br /> {| class=&quot;wikitable&quot;<br /> ! BGA !! Name !! Description<br /> |-<br /> | P16 || UART0_TxD || Serial Transmit<br /> |-<br /> | P15 || UART0_RxD || Serial Receive<br /> |-<br /> |}<br /> <br /> You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). (Convenient solder points are available on JSD/JTP-001 by the NOR test points. They are marked as '?' in [[:File:JSD-001 NOR - nor testpoints.png|marcan' noraliser / judges' NORway install picture]], closest to the ground at the bottom - RX is left, TX is right) Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:<br /> <br /> '''&lt;command&gt;:&lt;hash&gt;'''<br /> <br /> Where the hash is the sum of command bytes &amp; 0xFF<br /> <br /> you should terminate commands with \r\n, the syscon messages are only terminated with \n<br /> <br /> === Samples ===<br /> Here are some of the commands/messages encountered:<br /> <br /> Messages:<br /> &lt;pre&gt;Power applied (standby mode)<br /> OK 00000000:3A<br /> <br /> Power on<br /> # (PowerOn State):7F<br /> <br /> Power off (Hard shutdown)<br /> # (PowerOff State):DD<br /> <br /> After Fan test:<br /> # (PowerOff State) (Fatal):36<br /> <br /> No text, invalid hash:<br /> NG F0000002:4D&lt;/pre&gt;<br /> <br /> Commands:<br /> &lt;pre&gt;VER:ED<br /> OK 00000000 S1E 00 00 065D:A4<br /> <br /> ERRLOG:CB<br /> OK 00000000:3A<br /> <br /> DATE:1E<br /> NG F0000003:4E<br /> <br /> C:F1:BUZ<br /> E:4F:NG F0000004<br /> E:50:NG F0000005 (in DIAG mode)<br /> <br /> C:D0:CID<br /> E:50:NG F0000005<br /> <br /> C:D0:CID GET<br /> E:50:NG F0000005<br /> <br /> C:DA:EEP<br /> E:50:NG F0000005<br /> <br /> C:DA:EEP GET<br /> E:50:NG F0000005<br /> <br /> C:E6:EEP SET<br /> E:50:NG F0000005<br /> <br /> C:D5:FAN<br /> E:50:NG F0000005<br /> <br /> C:83:FAN START<br /> E:50:NG F0000005<br /> <br /> C:3B:FAN STOP<br /> E:50:NG F0000005<br /> <br /> C:F4:KSV<br /> E:50:NG F0000005<br /> <br /> C:ED:REV<br /> E:50:NG F0000005<br /> <br /> C:F8:SPU<br /> E:50:NG F0000005<br /> <br /> C:FD:AUTH1 <br /> 0000802000000000003000309C0EDB3F<br /> E603EDB98A38DDC09400A2AB2DDE8CAB<br /> 0AECFE951FF7E2E8D8A7CF2202719F81<br /> 2F36DE83B424C27063C274CB0000E46B<br /> &lt;Important Note: 0x40 bytes&gt;<br /> <br /> E:5D:NG E00000C0<br /> <br /> C:34:BOOT<br /> E:50:NG F0000005<br /> <br /> &lt;/pre&gt;<br /> more [[Talk:System_Controller_Firmware#Syscon_commands|Syscon commands]]<br /> <br /> bruteforcing commands:&lt;!--// LOL //--&gt; http://pastebin.com/CNei0xbC&lt;br&gt;<br /> <br /> VERY IMPORTANT:<br /> * Max size of a command is 11 characters,16 if you count with C:&lt;hash&gt;:<br /> * Sending a command with 11 chars results in NO OUTPUT<br /> * Sending a command with more than 11 chars results in NG F0000002<br /> * Max size of a command on DECR is 135, 140 if you count with C:&lt;hash&gt;:<br /> <br /> == Syscon (SPI) EEPROM ==<br /> {| class=&quot;wikitable&quot;<br /> ! BGA !! Name !! Description<br /> |-<br /> | F16 || CSB || Chip Select (needs to be low)<br /> |-<br /> | H16 || DO || Serial Data Output<br /> |-<br /> | G16 || DI || Serial Data Input<br /> |-<br /> | E16 || SKB || Serial Data Clock<br /> |-<br /> | J15 || WCB || Write Protect<br /> |-<br /> | J16 || RBB || Ready/Busy<br /> |-<br /> | G11 || VDDep || + 3.3V<br /> |-<br /> | C15 || VSSep || GND<br /> |-<br /> |}<br /> <br /> == Syscon JTAG ==<br /> disabled in factory after production on retailmodels<br /> {| class=&quot;wikitable&quot;<br /> ! BGA !! Name !! Description<br /> |-<br /> | L8 || JRTCK || Return Test Clock<br /> |-<br /> | K8 || JTCK || Test Clock<br /> |-<br /> | K9 || JTDO || Test Data Out<br /> |-<br /> | L9 || JTMS || Test Mode State / Test Mode Select<br /> |-<br /> | K7 || JTDI || Test Data In<br /> |-<br /> | L7 || JNTRST || Test Reset<br /> |-<br /> |}<br /> <br /> = Syscon Underlaying ports =<br /> == Syscon Cell SPI Bus ==<br /> {| class=&quot;wikitable&quot;<br /> ! BGA !! Name !! Description<br /> |-<br /> | M2 || /BE_SPI_CS || Chip Select<br /> |-<br /> | N2 || BE_SPI_DO || Serial Data Output<br /> |-<br /> | M1 || BE_SPI_DI || Serial Data Input<br /> |-<br /> | N1 || BE_SPI_CLK || Serial Data Clock<br /> |-<br /> | P2 || /BE_RESET || CellBE Reset<br /> |-<br /> | P1 || BE_POWGOOD || CellBE PowerGood<br /> |-<br /> | T2 || /BE_INT || CellBE Interrupt<br /> |-<br /> |}<br /> <br /> == Syscon Southbridge SPI Bus ==<br /> {| class=&quot;wikitable&quot;<br /> ! BGA !! Name !! Description<br /> |-<br /> | B9 || /SB_SPI_CS || Chip Select<br /> |-<br /> | B8 || SB_SPI_DO || Serial Data Output<br /> |-<br /> | A9 || SB_SPI_DI || Serial Data Input<br /> |-<br /> | A8 || SB_SPI_CLK || Serial Data Clock<br /> |-<br /> |}<br /> <br /> &lt;!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //--&gt;<br /> <br /> <br /> {{Motherboard Components}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=2.01_DEX&diff=48445 2.01 DEX 2018-03-19T18:10:22Z <p>93.108.187.41: /* Download */</p> <hr /> <div>= Changes =<br /> <br /> = Download =<br /> <br /> * https://www.sendspace.com/file/iyupwa (ROS only)<br /> * https://www.sendspace.com/file/j9wdmp (dev_flash)<br /> <br /> = ROS Hashes =<br /> <br /> = ROS Information =<br /> <br /> = Dev Flash Hashes =<br /> <br /> = Dev Flash Information =<br /> <br /> {{System Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Talk:1.00_CEX&diff=48272 Talk:1.00 CEX 2018-02-23T15:38:48Z <p>93.108.187.41: </p> <hr /> <div>==Firmware updates archaeology 1.00, 1.02, 1.10, etc...==<br /> *Links to wiki pages: [[System Firmware]] {{dot}} [[1.00 CEX]] {{dot}} [[1.02 CEX]] {{dot}} [[1.10 CEX]] {{dot}} [[1.11 CEX]]<br /> <br /> ===Problems===<br /> <br /> ====Mobile Suit Gundman Target in Sight (BLJS10002)====<br /> Link and release date: ([http://www.jp.playstation.com/software/title/bljs10002.html BLJS10002] 2006/11/11)<br /> <br /> We have two pages in wiki that tells the same game disc BLJS10002 includes two different firmware updates versions: [[1.02 CEX]] and [[1.11 CEX]], thats literally imposible so one of them is wrong, and based in the info posted in [[1.02 CEX]] (where appears the hash of the &quot;RETAIL/CEX-DISK&quot;, different than the hash of the &quot;1.02 RETAIL/CEX&quot; because for disc releases the file is padded with zeroes) it makes me think that info is right and BLJS10002 contains update 1.02 (so the info in 1.11 page about BLJS10002 is wrong)<br /> <br /> * Well, to prove this, someone would need to buy the disc from this game, dumping the Game and verifiying the Firmware but I think [[1.02 CEX]] makes more sense since it was released on launch day. I found [http://www.edepot.com/playstation3.html#PS3_Firmware here] that [[1.10 CEX]] was released one day after launch (and [[1.11 CEX]] 17 days later) but such Games got pressed on disc at least 2 weeks before release from my real life experience (in real life, I don't press PS3 Games, but other &quot;stuff&quot; on Blu-ray Discs which can take even more time depending on the &quot;application&quot;). This update allowed PSN support, which would make sense since everyone were able then to play online against each other on Day 1, or at least Day 2.<br /> <br /> ====But wait... so CEX 1.00 existed at some point ?====<br /> There are basically two reasons why the bluray game discs contains a firmware update, 1) because the game requires it, and 2) because this way is posble for all consumers included the ones without an internet connection to play the game by installing the firmware updated required by the game<br /> <br /> * It's likely both because I never saw any Game where [[PARAM.SFO]] says it needs Firmware [[1.11 CEX]] but the Disc includes a disc-based version of [[1.02 CEX]] only.<br /> <br /> It seems that BLJS10002 included 1.02 firmware update ...so this means at that time existed some PS3 with a lower firmware installed, right ?, and it needs to be 1.00 or 1.01<br /> <br /> * This could be and this was the reason why I posted my PS3's Guarantee Card on [[1.10 CEX]]. My console was bought by the end of December with [[1.10 CEX]] pre-installed and it still runs on this firmware.<br /> <br /> Also we know other firwares 1.00 exists: [[1.00 DEX]], [[1.00 DECR]], [[1.00 AV]] (this last one contains the emulators with compilation timestamps)<br /> <br /> * The earliest known fw differentiation between DEX and DECR was 0.85 &lt;!-- euss has/had 0.85 DEX fw --&gt;. The CEX prototype CBEH-1000-D was properly built around the same time as the DEH-H1001-D (the suffix denotes the stage of the prototype, -E came with 0.95), which came with 0.85. So it would make sense that there is 1.00 CEX, because there was also 1.00 DEX and DECR.<br /> ** This could be for non-retail Hardware for sure since my experience showed that Version &quot;X.XX&quot; got always released for DEX, SEX, &lt;!-- why they called it SEX ??? :P --&gt; DECR, AV, ARCADE and so on way before the same Version &quot;X.XX&quot; got released for a retail CEX version, which makes sense, since Sony use probably at least DEX hardware to test out things on newer Firmwares (see 3D functionality on DEX FW vs. CEX FW for example).<br /> *** I don't know if the following Sony did for the PS3 Firmware Releases but on PS4, the newest Firmware is always finished and &quot;ready or installment&quot; way before it's publlc release. See the latest Firmware Update 5.01, which got released on '''24&lt;sup&gt;th&lt;/sup&gt; October 2017''' but the direct download link shares the '''filedate''' together with the MD5 checksum, which mismatches in this case --&gt; [http://djp01.ps4.update.playstation.net/update/ps4/image/2017_1018/sys_8606691c0201e4db2a4100f80fbaddb3/PS4UPDATE.PUP?dest=jp http://djp01.ps4.update.playstation.net/update/ps4/image/'''2017_1018'''/sys_8606691c0201e4db2a4100f80fbaddb3/PS4UPDATE.PUP?dest=jp] (6 days before public release but no one can download this Update File before since the ps3-updatelist.xml needs to get updated as well). This means that [[1.00 CEX]] could be finished on 11&lt;sup&gt;th&lt;/sup&gt; November 2006, but also on October or even way longer before. If Sony worked with this system for the PS3 as well, then I think you will never can say if there was a [[1.00 CEX]] Update File since there is no 100% proof that Sony worked this out like above mentioned with the DEX and DECR versions compared to the CEX releases. And with those Date mismatches, it makes it way more difficult to find any [[1.00 CEX]] Update File, especially without any MD5 hash. On the other hand, no one knows when Sony started to implement this ps3-updatelist.xml feature especially if they implemented it already on Day 1 after release. Sadly the waybackmachine has only entries until March 2007 :(<br /> **** And yes, they probably did the same for the PS3, check the &quot;imageBuildDate&quot; from the following two pictures right after the Version Number:<br /> ***** http://www.psdevwiki.com/ps3/images/9/9c/MoreSystemInformation-CECHA01-102.JPG<br /> ***** http://www.psdevwiki.com/ps3/images/d/d3/IMG_0148.JPG<br /> **** [[1.02 CEX]] and [[1.10 CEX]] were already finished way before the PS3 was released. This could even mean that if you bought a PS3 on 11&lt;sup&gt;th&lt;/sup&gt; November 2006, you already had Firmware [[1.02 CEX]] pre-installed, which would also make sense that all japanese Launch titles shares the same MD5 hashes for the included disc-based Update File, which is the MD5 hash for the disc-based [[1.02 CEX]] Update file like on this Mobile Suit Gundman Game (Google for &quot;df96debb4c014f5673e0ce259e4fb835&quot; and you will find a lot of hashes shared on several japanese launch titles). This means that if you bought a PS3 at Launch Day, there was no need to Update your PS3 to play the launch games, since the PS3 was &quot;up to date&quot; at that time with both pre-installed [[1.02 CEX]] and the same Version on your launch title Discs. So [[1.00 CEX]] was never released in public probably.<br /> **** The build date shown in that screens such http://www.psdevwiki.com/ps3/images/d/d3/IMG_0148.JPG is the same that can be seen in the emualtor timestamps here http://www.psdevwiki.com/ps3/Talk:PS2_Emulation#PS2_Emulator_Types_and_Revisions, by looking at that emualtor timestamps it can be seen where the &quot;clicked&quot; in the compile button (or run the make -all command, or activated the &quot;buildbot&quot; server, or whatever hehe), by looking at that timestamps i think all the firmware &quot;families&quot; are compiled in a row... this dates should be different than the date where they makes the firmwares availables for sure, the firmwares are compiled a day and several dates later (when passes all the testigs) enters in production (send to the factories, game companies, included in SDKs, availables in web servers, etc...)<br /> As an interesting comparison, the only difference in between ps2_emu.elf (decrypted) from firmwares [[1.30 AV]] and [[1.30 CEX]] are 3 bytes of the timestamp, ps2_emu.elf for [[1.30 CEX]] was compiled at 06/12/05/05:33 and ps2_emu.elf for [[1.30 AV]] 06/12/05/07:15... around 2 hours after, based on this we can deduce the ps2_emu.elf for [[1.00 CEX]] was compiled a couple of hours before the ps2_emu.elf for [[1.00 AV]] and the code of that ps2_emu.elf was exactly the same (except the timestamp with the delay of two hours)<br /> <br /> * Hmm, maybe we could compare this with the relase from the PS4. Launch Day Devices where on 1.00 ???<br /> <br /> * There's no 1.00 CEX firmware on a launch model, similarly to how there's no 1.00 CEX firmware on a launch game. Similar to how PS4 was released to the market, PS3s came with 1.01 fw pre installed. PS4s instead came with 1.01 pre installed, and later, when sony figured out this contained some bugs, they put available in the market 1.05 PS4s.<br /> <br /> ====PS3 launch games availables====<br /> The release date of the first PS3 model in japan matches with the release of BLJS10002... that date was 2006/11/11 as far as wikipedia and that official link to the store [http://www.jp.playstation.com/software/title/bljs10002.html BLJS10002]<br /> <br /> Im guessing this was one of the games availables at the PS3 release date in japan... the kind of thing you had to wait in a row for all night waiting for the shop to open at morning and you could buy the CECHA00 + BLJS10002<br /> <br /> Perhaps that first CECHA00 models was shipped with firmware 1.00... and that same day people updated them to 1.02 with the disc<br /> <br /> * Sounds logical but yep, those people were crazy waiting in a row for several days just to buy a toaster :P (see --&gt; https://www.youtube.com/watch?v=tEfamAuJR_8 --- Yes, this video was uploaded 1 day before launch oO)<br /> <br /> ====So where is CEX 1.00 ?====<br /> Most probably was used at factory and it was not used for much time because was replaced at factories soon by a higher firmware version, or the consoles was updated manually (as a second firmware installation)<br /> <br /> So probably we will never see the firmware 1.00 PUP, the only way to take a peek at the files that was used in it is to make a flash dump of a CECHA00 that was never updated manually, or was updated a max of one times manualy, because the flash has two &quot;banks&quot; there are some files from the &quot;previous&quot; firmware installation that remains in it<br /> <br /> * I think this is the same for the PS4.<br /> <br /> ====Wikipedia may be the source of errors====<br /> https://en.wikipedia.org/wiki/PlayStation_3_system_software#History_of_updates<br /> The first sentences in that link is weird, if is true that all the consoles had 1.10 installed at release date then the 1.02 update inside BLJS10002 and other launch games was pointless, it could be because the games was manufactured/pressed way before the PS3 release date, but still i dont like this theory... it could be interesting to see whcih firmware updates was included in other &quot;available at launch day&quot; games<br /> <br /> * Actually there was a time I liked the entry from the official Wikipedia itself since it listed every update and all functions in detail in a big table but for some reasons, they removed it. Several people claiming it in the Talk page to bring this back but you can look for an older revision like here --&gt; https://en.wikipedia.org/w/index.php?title=PlayStation_3_system_software&amp;oldid=676645457<br /> <br /> ====Build dates of the first firmware versions====<br /> {| class=&quot;wikitable&quot; style=&quot;font-size:xx-small;&quot;<br /> |-<br /> ! Firmware !! build date<br /> |-<br /> ! [[1.00_AV|1.00 AV]]<br /> | 06/10/04/12:16 (real timestamp for CEX should be around 1:30 before)<br /> |-<br /> ! [[1.02_CEX|1.02]]<br /> | 06/10/21/00:01<br /> |-<br /> ! [[1.10_CEX|1.10]]<br /> | 06/11/09/06:09<br /> |-<br /> ! [[1.11_CEX|1.11]]<br /> | 06/11/21/17:55<br /> |-<br /> ! [[1.30_CEX|1.30]]<br /> | 06/12/05/05:34<br /> |-<br /> ! [[1.31_CEX|1.31]]<br /> | 06/12/12/18:48<br /> |-<br /> ! [[1.32_CEX|1.32]]<br /> | 06/12/18/05:55<br /> |-<br /> ! [[1.50_CEX|1.50]]<br /> | 07/01/18/22:53<br /> |}</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Debian_LiveCD&diff=47436 Debian LiveCD 2017-12-02T17:00:05Z <p>93.108.187.41: /* CDROM */</p> <hr /> <div>[[Category:OtherOS]]<br /> <br /> =Introduction=<br /> <br /> * Sometimes we need to boot Linux without HDD e.g. if you want to experiment with HDD encryption, enable/disable it without causing damage to your data. For such cases we need a LiveCD which doesn't mount HDD at boot.<br /> <br /> =Creating Initial System with debootstrap=<br /> <br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> apt-get install debootstrap<br /> <br /> mkdir livecd<br /> <br /> debootstrap --arch powerpc squeeze /root/livecd http://ftp.us.debian.org/debian<br /> <br /> # Grab a beer and reverse some PS3 stuff in the meantime :)<br /> <br /> # Enter chroot environment<br /> <br /> mount -t proc none /root/livecd/proc<br /> mount --rbind /dev /root/livecd/dev<br /> LANG=C chroot /root/livecd /bin/bash<br /> <br /> export TERM=xterm-color<br /> <br /> echo &quot;debian&quot; &gt; /etc/hostname<br /> <br /> dpkg-reconfigure tzdata<br /> <br /> # Configure network interfaces<br /> <br /> cat /etc/network/interfaces<br /> ---<br /> auto lo<br /> iface lo inet loopback<br /> <br /> allow-hotplug eth0<br /> iface eth0 inet dhcp<br /> <br /> allow-hotplug wlan0<br /> iface wlan0 inet dhcp<br /> wpa-ssid ssid<br /> wpa-psk psk<br /> -EOF-<br /> <br /> # Configure APT<br /> <br /> cat /etc/apt/sources.list<br /> ---<br /> <br /> deb http://ftp.us.debian.org/debian squeeze main<br /> deb-src http://ftp.us.debian.org/debian squeeze main<br /> <br /> deb http://security.debian.org squeeze/updates main<br /> deb-src http://security.debian.org squeeze/updates main<br /> -EOF-<br /> <br /> aptitude update<br /> <br /> aptitude install locales<br /> dpkg-reconfigure locales<br /> aptitude install console-data<br /> dpkg-reconfigure console-data<br /> <br /> tasksel install standard<br /> aptitude install binutils gcc make git vim openssh-server sudo wireless-tools wpasupplicant libssl-dev libncurses5-dev<br /> aptitude install gcc-spu g++-spu newlib-spu spu-tools<br /> aptitude install parted kpartx cryptsetup libreadline-dev libaio-dev libdevmapper-dev libudev-dev<br /> <br /> # Make SSH server start at boot so we could ssh to our LiveCD<br /> <br /> update-rc.d ssh defaults<br /> <br /> aptitude clean<br /> <br /> rm -f /etc/udev/rules.d/70-persistent-net.rules<br /> <br /> # exit chroot environment<br /> <br /> exit<br /> <br /> # Unmount dev and proc<br /> <br /> umount /root/livecd/dev/shm<br /> umount /root/livecd/dev/pts<br /> umount /root/livecd/dev<br /> umount /root/livecd/proc<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Creating Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root/livecd<br /> mksquashfs * ../root.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Modifying Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root<br /> unsquashfs root.sfs<br /> cd squashfs-root<br /> <br /> # Make your changes<br /> <br /> mksquashfs * ../root-changed.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Linux 3 Kernel=<br /> <br /> * We need a Linux 3 kernel with overlayfs support so we could create a tmpfs over our read-only base filesystem.<br /> * Furthermore, we want to compile PS3 HDD driver as module because in this case we can easily change HDD region flags.<br /> <br /> See my GIT repos:<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-configs<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-34<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-35<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-36<br /> * http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> =Initramfs=<br /> <br /> See my GIT repo: http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> ==BusyBox==<br /> <br /> * We need a couple of user-space applications to mount filesystems, load kernel modules and so on.<br /> * And make sure you compile BusyBox without any library dependencies.<br /> * I compiled my BusyBox executable on PS3 Linux but you could cross-compile it too but then you need a complete PowerPC toolchain with libc.<br /> <br /> &lt;pre&gt;<br /> http://busybox.net/downloads/busybox-1.20.1.tar.bz2<br /> <br /> tar xvjf busybox-1.20.1.tar.bz2<br /> cd busybox-1.20.1<br /> make menuconfig<br /> make<br /> &lt;/pre&gt;<br /> <br /> ==Creating Image==<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> <br /> # Populate initramfs<br /> <br /> mkdir initramfs<br /> cd initramfs<br /> mkdir -p bin dev etc lib/modules/3.6.4 mnt proc sbin sys usr/bin usr/sbin<br /> <br /> cp ~/busybox-1.20.1/busybox bin/<br /> cd bin<br /> ln -sf busybox sh<br /> cd ..<br /> <br /> echo 'sda.* 0:6 0660' &gt;&gt; etc/mdev.conf<br /> echo 'sr[0-9] 0:6 0660 @ln -sf $MDEV cdrom' &gt;&gt; etc/mdev.conf<br /> <br /> cat &gt;etc/modules &lt;&lt;EOF<br /> &gt; fat<br /> &gt; vfat<br /> &gt; isofs<br /> &gt; crc-ccitt<br /> &gt; crc-itu-t<br /> &gt; lzo_compress<br /> &gt; udf<br /> &gt; squashfs<br /> &gt; overlayfs<br /> &gt; ps3_gelic<br /> &gt; ps3stor_lib<br /> &gt; sg<br /> &gt; ps3rom<br /> &gt; usb-common<br /> &gt; usbcore<br /> &gt; ehci-hcd<br /> &gt; ohci-hcd<br /> &gt; usb-storage<br /> &gt; EOF<br /> <br /> for mod in fat vfat isofs crc-ccitt crc-itu-t lzo_compress udf squashfs overlayfs \<br /> ps3_gelic ps3stor_lib sg ps3rom usb-common usbcore ehci-hcd ohci-hcd usb-storage; do<br /> path=`find /home/glevand/linux-3.6.4-build/lib/modules/3.6.4 -name $mod.ko`<br /> cp $path lib/modules/3.6.4/<br /> done<br /> <br /> # Create initramfs<br /> <br /> find . | cpio -H newc -o &gt; ../initramfs.cpio<br /> cd ..<br /> cat initramfs.cpio | gzip &gt; initramfs.cpio.gz<br /> <br /> # Make changes to initramfs<br /> <br /> gunzip initramfs.cpio.gz<br /> mkdir initramfs<br /> cd initramfs<br /> cpio -i -d -H newc --no-absolute-filenames &lt; ../initramfs.cpio<br /> &lt;/syntaxhighlight&gt;}}<br /> =Images=<br /> <br /> * vmlinux-3.6.4.xz: http://www.multiupload.nl/D0PYT6HGC0 (MD5 4b5fdb2995fde82e0f6817a7a86fca2c)<br /> * root.sfs: http://www.multiupload.nl/MWDSBR4OJZ (MD5 3ee12e2d351e0bbe1cd7818be23d8973)<br /> * Tools available on the root filesystem: gcc, spu-gcc, spuisofs, spuldrfs, ps3vuart-tools, ps3sed and all my other PS3 Linux drivers. Everything you need to compile and test various PS3 stuff.<br /> * In case someone still hasn't figured it out yet, password for root is root and password for glevand is glevand :)<br /> * I enabled DHCP on Ethernet.<br /> * You could use WLAN too but for that you have to modify the root filesystem and configure your SSID and PSK in /etc/network/interfaces.<br /> <br /> ==USB==<br /> <br /> * Your USB drive should be formatted with FAT32 filesystem.<br /> * initramfs-usb.cpio.gz: http://www.multiupload.nl/Y084SCQBL3 (MD5 f94b6aec2e5fbbb26f7d466165071469)<br /> * Create '''debianlive''' directory on your USB drive.<br /> * Put vmlinux-3.6.4 (extract xz archive), initramfs.cpio.gz and root.sfs into this directory.<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> $ ls -l /mnt/usb/debianlive/<br /> total 257696<br /> -rwxr-xr-x 1 root root 6746154 Aug 18 17:44 initramfs.cpio.gz<br /> -rwxr-xr-x 1 root root 249835520 Aug 18 17:15 root.sfs<br /> -rwxr-xr-x 1 root root 7288832 Aug 18 17:31 vmlinux-3.6.4<br /> $ ls -l /mnt/usb/<br /> -rwxr-xr-x 1 root root 188 Aug 18 17:30 kboot.conf<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> * And create kboot.conf in the root directory of your USB drive with this content:<br /> <br /> &lt;pre&gt;<br /> debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz<br /> &lt;/pre&gt;<br /> <br /> ==CDROM==<br /> <br /> (files seem missing)<br /> <br /> * initramfs-cdrom.cpio.gz: http://www.multiupload.nl/SA9YK1HFK0 (MD5 f71f8667dc52540136f90a95d7111efc)<br /> * debianlive.iso: http://www.multiupload.nl/TW41UIVAGV (MD5 eeba4fa3428c5d687bada3fd975ea9dd)<br /> * https://www.sendspace.com/file/2negnt (added missing link to debianlive)<br /> * https://mega.nz/#!k1sTXI4a!ANmRDBVYmEdaToauoePNSKvoDl7GXGw0ORNN9ZM0Tfo<br /> * https://www.sendspace.com/file/f8wnpe<br /> * http://uploaded.net/file/vdxmzopu<br /> &lt;!-- https://www.sendspace.com/file/a3bsty --&gt;<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> mkdir -p iso/debianlive<br /> cp root.sfs initramfs.cpio.gz vmlinux-3.6.4 iso/debianlive<br /> echo &quot;debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz&quot; &gt; iso/kboot.conf<br /> cd iso<br /> mkisofs -R -J -l -o ../debianlive.iso .<br /> cd ..<br /> <br /> sudo cdrecord -v dev=/dev/sr0 blank=fast<br /> sudo cdrecord -v dev=/dev/sr0 debianlive.iso<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Links=<br /> <br /> * http://securityfocus.eu/?p=149<br /> <br /> <br /> <br /> {{Linux}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Debian_LiveCD&diff=47435 Debian LiveCD 2017-12-02T16:59:23Z <p>93.108.187.41: /* CDROM */</p> <hr /> <div>[[Category:OtherOS]]<br /> <br /> =Introduction=<br /> <br /> * Sometimes we need to boot Linux without HDD e.g. if you want to experiment with HDD encryption, enable/disable it without causing damage to your data. For such cases we need a LiveCD which doesn't mount HDD at boot.<br /> <br /> =Creating Initial System with debootstrap=<br /> <br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> apt-get install debootstrap<br /> <br /> mkdir livecd<br /> <br /> debootstrap --arch powerpc squeeze /root/livecd http://ftp.us.debian.org/debian<br /> <br /> # Grab a beer and reverse some PS3 stuff in the meantime :)<br /> <br /> # Enter chroot environment<br /> <br /> mount -t proc none /root/livecd/proc<br /> mount --rbind /dev /root/livecd/dev<br /> LANG=C chroot /root/livecd /bin/bash<br /> <br /> export TERM=xterm-color<br /> <br /> echo &quot;debian&quot; &gt; /etc/hostname<br /> <br /> dpkg-reconfigure tzdata<br /> <br /> # Configure network interfaces<br /> <br /> cat /etc/network/interfaces<br /> ---<br /> auto lo<br /> iface lo inet loopback<br /> <br /> allow-hotplug eth0<br /> iface eth0 inet dhcp<br /> <br /> allow-hotplug wlan0<br /> iface wlan0 inet dhcp<br /> wpa-ssid ssid<br /> wpa-psk psk<br /> -EOF-<br /> <br /> # Configure APT<br /> <br /> cat /etc/apt/sources.list<br /> ---<br /> <br /> deb http://ftp.us.debian.org/debian squeeze main<br /> deb-src http://ftp.us.debian.org/debian squeeze main<br /> <br /> deb http://security.debian.org squeeze/updates main<br /> deb-src http://security.debian.org squeeze/updates main<br /> -EOF-<br /> <br /> aptitude update<br /> <br /> aptitude install locales<br /> dpkg-reconfigure locales<br /> aptitude install console-data<br /> dpkg-reconfigure console-data<br /> <br /> tasksel install standard<br /> aptitude install binutils gcc make git vim openssh-server sudo wireless-tools wpasupplicant libssl-dev libncurses5-dev<br /> aptitude install gcc-spu g++-spu newlib-spu spu-tools<br /> aptitude install parted kpartx cryptsetup libreadline-dev libaio-dev libdevmapper-dev libudev-dev<br /> <br /> # Make SSH server start at boot so we could ssh to our LiveCD<br /> <br /> update-rc.d ssh defaults<br /> <br /> aptitude clean<br /> <br /> rm -f /etc/udev/rules.d/70-persistent-net.rules<br /> <br /> # exit chroot environment<br /> <br /> exit<br /> <br /> # Unmount dev and proc<br /> <br /> umount /root/livecd/dev/shm<br /> umount /root/livecd/dev/pts<br /> umount /root/livecd/dev<br /> umount /root/livecd/proc<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Creating Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root/livecd<br /> mksquashfs * ../root.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Modifying Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root<br /> unsquashfs root.sfs<br /> cd squashfs-root<br /> <br /> # Make your changes<br /> <br /> mksquashfs * ../root-changed.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Linux 3 Kernel=<br /> <br /> * We need a Linux 3 kernel with overlayfs support so we could create a tmpfs over our read-only base filesystem.<br /> * Furthermore, we want to compile PS3 HDD driver as module because in this case we can easily change HDD region flags.<br /> <br /> See my GIT repos:<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-configs<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-34<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-35<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-36<br /> * http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> =Initramfs=<br /> <br /> See my GIT repo: http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> ==BusyBox==<br /> <br /> * We need a couple of user-space applications to mount filesystems, load kernel modules and so on.<br /> * And make sure you compile BusyBox without any library dependencies.<br /> * I compiled my BusyBox executable on PS3 Linux but you could cross-compile it too but then you need a complete PowerPC toolchain with libc.<br /> <br /> &lt;pre&gt;<br /> http://busybox.net/downloads/busybox-1.20.1.tar.bz2<br /> <br /> tar xvjf busybox-1.20.1.tar.bz2<br /> cd busybox-1.20.1<br /> make menuconfig<br /> make<br /> &lt;/pre&gt;<br /> <br /> ==Creating Image==<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> <br /> # Populate initramfs<br /> <br /> mkdir initramfs<br /> cd initramfs<br /> mkdir -p bin dev etc lib/modules/3.6.4 mnt proc sbin sys usr/bin usr/sbin<br /> <br /> cp ~/busybox-1.20.1/busybox bin/<br /> cd bin<br /> ln -sf busybox sh<br /> cd ..<br /> <br /> echo 'sda.* 0:6 0660' &gt;&gt; etc/mdev.conf<br /> echo 'sr[0-9] 0:6 0660 @ln -sf $MDEV cdrom' &gt;&gt; etc/mdev.conf<br /> <br /> cat &gt;etc/modules &lt;&lt;EOF<br /> &gt; fat<br /> &gt; vfat<br /> &gt; isofs<br /> &gt; crc-ccitt<br /> &gt; crc-itu-t<br /> &gt; lzo_compress<br /> &gt; udf<br /> &gt; squashfs<br /> &gt; overlayfs<br /> &gt; ps3_gelic<br /> &gt; ps3stor_lib<br /> &gt; sg<br /> &gt; ps3rom<br /> &gt; usb-common<br /> &gt; usbcore<br /> &gt; ehci-hcd<br /> &gt; ohci-hcd<br /> &gt; usb-storage<br /> &gt; EOF<br /> <br /> for mod in fat vfat isofs crc-ccitt crc-itu-t lzo_compress udf squashfs overlayfs \<br /> ps3_gelic ps3stor_lib sg ps3rom usb-common usbcore ehci-hcd ohci-hcd usb-storage; do<br /> path=`find /home/glevand/linux-3.6.4-build/lib/modules/3.6.4 -name $mod.ko`<br /> cp $path lib/modules/3.6.4/<br /> done<br /> <br /> # Create initramfs<br /> <br /> find . | cpio -H newc -o &gt; ../initramfs.cpio<br /> cd ..<br /> cat initramfs.cpio | gzip &gt; initramfs.cpio.gz<br /> <br /> # Make changes to initramfs<br /> <br /> gunzip initramfs.cpio.gz<br /> mkdir initramfs<br /> cd initramfs<br /> cpio -i -d -H newc --no-absolute-filenames &lt; ../initramfs.cpio<br /> &lt;/syntaxhighlight&gt;}}<br /> =Images=<br /> <br /> * vmlinux-3.6.4.xz: http://www.multiupload.nl/D0PYT6HGC0 (MD5 4b5fdb2995fde82e0f6817a7a86fca2c)<br /> * root.sfs: http://www.multiupload.nl/MWDSBR4OJZ (MD5 3ee12e2d351e0bbe1cd7818be23d8973)<br /> * Tools available on the root filesystem: gcc, spu-gcc, spuisofs, spuldrfs, ps3vuart-tools, ps3sed and all my other PS3 Linux drivers. Everything you need to compile and test various PS3 stuff.<br /> * In case someone still hasn't figured it out yet, password for root is root and password for glevand is glevand :)<br /> * I enabled DHCP on Ethernet.<br /> * You could use WLAN too but for that you have to modify the root filesystem and configure your SSID and PSK in /etc/network/interfaces.<br /> <br /> ==USB==<br /> <br /> * Your USB drive should be formatted with FAT32 filesystem.<br /> * initramfs-usb.cpio.gz: http://www.multiupload.nl/Y084SCQBL3 (MD5 f94b6aec2e5fbbb26f7d466165071469)<br /> * Create '''debianlive''' directory on your USB drive.<br /> * Put vmlinux-3.6.4 (extract xz archive), initramfs.cpio.gz and root.sfs into this directory.<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> $ ls -l /mnt/usb/debianlive/<br /> total 257696<br /> -rwxr-xr-x 1 root root 6746154 Aug 18 17:44 initramfs.cpio.gz<br /> -rwxr-xr-x 1 root root 249835520 Aug 18 17:15 root.sfs<br /> -rwxr-xr-x 1 root root 7288832 Aug 18 17:31 vmlinux-3.6.4<br /> $ ls -l /mnt/usb/<br /> -rwxr-xr-x 1 root root 188 Aug 18 17:30 kboot.conf<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> * And create kboot.conf in the root directory of your USB drive with this content:<br /> <br /> &lt;pre&gt;<br /> debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz<br /> &lt;/pre&gt;<br /> <br /> ==CDROM==<br /> <br /> (files seem missing)<br /> <br /> * initramfs-cdrom.cpio.gz: http://www.multiupload.nl/SA9YK1HFK0 (MD5 f71f8667dc52540136f90a95d7111efc)<br /> * debianlive.iso: http://www.multiupload.nl/TW41UIVAGV (MD5 eeba4fa3428c5d687bada3fd975ea9dd)<br /> * https://www.sendspace.com/file/2negnt (added missing link to debianlive)<br /> * https://mega.nz/#!k1sTXI4a!ANmRDBVYmEdaToauoePNSKvoDl7GXGw0ORNN9ZM0Tfo<br /> * https://www.sendspace.com/file/f8wnpe<br /> * http://uploaded.net/file/vdxmzopu<br /> &lt;--! https://www.sendspace.com/file/a3bsty --&gt;<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> mkdir -p iso/debianlive<br /> cp root.sfs initramfs.cpio.gz vmlinux-3.6.4 iso/debianlive<br /> echo &quot;debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz&quot; &gt; iso/kboot.conf<br /> cd iso<br /> mkisofs -R -J -l -o ../debianlive.iso .<br /> cd ..<br /> <br /> sudo cdrecord -v dev=/dev/sr0 blank=fast<br /> sudo cdrecord -v dev=/dev/sr0 debianlive.iso<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Links=<br /> <br /> * http://securityfocus.eu/?p=149<br /> <br /> <br /> <br /> {{Linux}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Debian_LiveCD&diff=47434 Debian LiveCD 2017-12-02T16:53:11Z <p>93.108.187.41: /* CDROM */</p> <hr /> <div>[[Category:OtherOS]]<br /> <br /> =Introduction=<br /> <br /> * Sometimes we need to boot Linux without HDD e.g. if you want to experiment with HDD encryption, enable/disable it without causing damage to your data. For such cases we need a LiveCD which doesn't mount HDD at boot.<br /> <br /> =Creating Initial System with debootstrap=<br /> <br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> apt-get install debootstrap<br /> <br /> mkdir livecd<br /> <br /> debootstrap --arch powerpc squeeze /root/livecd http://ftp.us.debian.org/debian<br /> <br /> # Grab a beer and reverse some PS3 stuff in the meantime :)<br /> <br /> # Enter chroot environment<br /> <br /> mount -t proc none /root/livecd/proc<br /> mount --rbind /dev /root/livecd/dev<br /> LANG=C chroot /root/livecd /bin/bash<br /> <br /> export TERM=xterm-color<br /> <br /> echo &quot;debian&quot; &gt; /etc/hostname<br /> <br /> dpkg-reconfigure tzdata<br /> <br /> # Configure network interfaces<br /> <br /> cat /etc/network/interfaces<br /> ---<br /> auto lo<br /> iface lo inet loopback<br /> <br /> allow-hotplug eth0<br /> iface eth0 inet dhcp<br /> <br /> allow-hotplug wlan0<br /> iface wlan0 inet dhcp<br /> wpa-ssid ssid<br /> wpa-psk psk<br /> -EOF-<br /> <br /> # Configure APT<br /> <br /> cat /etc/apt/sources.list<br /> ---<br /> <br /> deb http://ftp.us.debian.org/debian squeeze main<br /> deb-src http://ftp.us.debian.org/debian squeeze main<br /> <br /> deb http://security.debian.org squeeze/updates main<br /> deb-src http://security.debian.org squeeze/updates main<br /> -EOF-<br /> <br /> aptitude update<br /> <br /> aptitude install locales<br /> dpkg-reconfigure locales<br /> aptitude install console-data<br /> dpkg-reconfigure console-data<br /> <br /> tasksel install standard<br /> aptitude install binutils gcc make git vim openssh-server sudo wireless-tools wpasupplicant libssl-dev libncurses5-dev<br /> aptitude install gcc-spu g++-spu newlib-spu spu-tools<br /> aptitude install parted kpartx cryptsetup libreadline-dev libaio-dev libdevmapper-dev libudev-dev<br /> <br /> # Make SSH server start at boot so we could ssh to our LiveCD<br /> <br /> update-rc.d ssh defaults<br /> <br /> aptitude clean<br /> <br /> rm -f /etc/udev/rules.d/70-persistent-net.rules<br /> <br /> # exit chroot environment<br /> <br /> exit<br /> <br /> # Unmount dev and proc<br /> <br /> umount /root/livecd/dev/shm<br /> umount /root/livecd/dev/pts<br /> umount /root/livecd/dev<br /> umount /root/livecd/proc<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Creating Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root/livecd<br /> mksquashfs * ../root.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Modifying Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root<br /> unsquashfs root.sfs<br /> cd squashfs-root<br /> <br /> # Make your changes<br /> <br /> mksquashfs * ../root-changed.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Linux 3 Kernel=<br /> <br /> * We need a Linux 3 kernel with overlayfs support so we could create a tmpfs over our read-only base filesystem.<br /> * Furthermore, we want to compile PS3 HDD driver as module because in this case we can easily change HDD region flags.<br /> <br /> See my GIT repos:<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-configs<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-34<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-35<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-36<br /> * http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> =Initramfs=<br /> <br /> See my GIT repo: http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> ==BusyBox==<br /> <br /> * We need a couple of user-space applications to mount filesystems, load kernel modules and so on.<br /> * And make sure you compile BusyBox without any library dependencies.<br /> * I compiled my BusyBox executable on PS3 Linux but you could cross-compile it too but then you need a complete PowerPC toolchain with libc.<br /> <br /> &lt;pre&gt;<br /> http://busybox.net/downloads/busybox-1.20.1.tar.bz2<br /> <br /> tar xvjf busybox-1.20.1.tar.bz2<br /> cd busybox-1.20.1<br /> make menuconfig<br /> make<br /> &lt;/pre&gt;<br /> <br /> ==Creating Image==<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> <br /> # Populate initramfs<br /> <br /> mkdir initramfs<br /> cd initramfs<br /> mkdir -p bin dev etc lib/modules/3.6.4 mnt proc sbin sys usr/bin usr/sbin<br /> <br /> cp ~/busybox-1.20.1/busybox bin/<br /> cd bin<br /> ln -sf busybox sh<br /> cd ..<br /> <br /> echo 'sda.* 0:6 0660' &gt;&gt; etc/mdev.conf<br /> echo 'sr[0-9] 0:6 0660 @ln -sf $MDEV cdrom' &gt;&gt; etc/mdev.conf<br /> <br /> cat &gt;etc/modules &lt;&lt;EOF<br /> &gt; fat<br /> &gt; vfat<br /> &gt; isofs<br /> &gt; crc-ccitt<br /> &gt; crc-itu-t<br /> &gt; lzo_compress<br /> &gt; udf<br /> &gt; squashfs<br /> &gt; overlayfs<br /> &gt; ps3_gelic<br /> &gt; ps3stor_lib<br /> &gt; sg<br /> &gt; ps3rom<br /> &gt; usb-common<br /> &gt; usbcore<br /> &gt; ehci-hcd<br /> &gt; ohci-hcd<br /> &gt; usb-storage<br /> &gt; EOF<br /> <br /> for mod in fat vfat isofs crc-ccitt crc-itu-t lzo_compress udf squashfs overlayfs \<br /> ps3_gelic ps3stor_lib sg ps3rom usb-common usbcore ehci-hcd ohci-hcd usb-storage; do<br /> path=`find /home/glevand/linux-3.6.4-build/lib/modules/3.6.4 -name $mod.ko`<br /> cp $path lib/modules/3.6.4/<br /> done<br /> <br /> # Create initramfs<br /> <br /> find . | cpio -H newc -o &gt; ../initramfs.cpio<br /> cd ..<br /> cat initramfs.cpio | gzip &gt; initramfs.cpio.gz<br /> <br /> # Make changes to initramfs<br /> <br /> gunzip initramfs.cpio.gz<br /> mkdir initramfs<br /> cd initramfs<br /> cpio -i -d -H newc --no-absolute-filenames &lt; ../initramfs.cpio<br /> &lt;/syntaxhighlight&gt;}}<br /> =Images=<br /> <br /> * vmlinux-3.6.4.xz: http://www.multiupload.nl/D0PYT6HGC0 (MD5 4b5fdb2995fde82e0f6817a7a86fca2c)<br /> * root.sfs: http://www.multiupload.nl/MWDSBR4OJZ (MD5 3ee12e2d351e0bbe1cd7818be23d8973)<br /> * Tools available on the root filesystem: gcc, spu-gcc, spuisofs, spuldrfs, ps3vuart-tools, ps3sed and all my other PS3 Linux drivers. Everything you need to compile and test various PS3 stuff.<br /> * In case someone still hasn't figured it out yet, password for root is root and password for glevand is glevand :)<br /> * I enabled DHCP on Ethernet.<br /> * You could use WLAN too but for that you have to modify the root filesystem and configure your SSID and PSK in /etc/network/interfaces.<br /> <br /> ==USB==<br /> <br /> * Your USB drive should be formatted with FAT32 filesystem.<br /> * initramfs-usb.cpio.gz: http://www.multiupload.nl/Y084SCQBL3 (MD5 f94b6aec2e5fbbb26f7d466165071469)<br /> * Create '''debianlive''' directory on your USB drive.<br /> * Put vmlinux-3.6.4 (extract xz archive), initramfs.cpio.gz and root.sfs into this directory.<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> $ ls -l /mnt/usb/debianlive/<br /> total 257696<br /> -rwxr-xr-x 1 root root 6746154 Aug 18 17:44 initramfs.cpio.gz<br /> -rwxr-xr-x 1 root root 249835520 Aug 18 17:15 root.sfs<br /> -rwxr-xr-x 1 root root 7288832 Aug 18 17:31 vmlinux-3.6.4<br /> $ ls -l /mnt/usb/<br /> -rwxr-xr-x 1 root root 188 Aug 18 17:30 kboot.conf<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> * And create kboot.conf in the root directory of your USB drive with this content:<br /> <br /> &lt;pre&gt;<br /> debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz<br /> &lt;/pre&gt;<br /> <br /> ==CDROM==<br /> <br /> (files seem missing)<br /> <br /> * initramfs-cdrom.cpio.gz: http://www.multiupload.nl/SA9YK1HFK0 (MD5 f71f8667dc52540136f90a95d7111efc)<br /> * debianlive.iso: http://www.multiupload.nl/TW41UIVAGV (MD5 eeba4fa3428c5d687bada3fd975ea9dd)<br /> * https://www.sendspace.com/file/2negnt (added missing link to debianlive)<br /> * https://mega.nz/#!k1sTXI4a!ANmRDBVYmEdaToauoePNSKvoDl7GXGw0ORNN9ZM0Tfo<br /> * https://www.sendspace.com/file/f8wnpe<br /> * http://uploaded.net/file/vdxmzopu<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> mkdir -p iso/debianlive<br /> cp root.sfs initramfs.cpio.gz vmlinux-3.6.4 iso/debianlive<br /> echo &quot;debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz&quot; &gt; iso/kboot.conf<br /> cd iso<br /> mkisofs -R -J -l -o ../debianlive.iso .<br /> cd ..<br /> <br /> sudo cdrecord -v dev=/dev/sr0 blank=fast<br /> sudo cdrecord -v dev=/dev/sr0 debianlive.iso<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Links=<br /> <br /> * http://securityfocus.eu/?p=149<br /> <br /> <br /> <br /> {{Linux}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Debian_LiveCD&diff=47433 Debian LiveCD 2017-12-02T16:46:08Z <p>93.108.187.41: /* CDROM */</p> <hr /> <div>[[Category:OtherOS]]<br /> <br /> =Introduction=<br /> <br /> * Sometimes we need to boot Linux without HDD e.g. if you want to experiment with HDD encryption, enable/disable it without causing damage to your data. For such cases we need a LiveCD which doesn't mount HDD at boot.<br /> <br /> =Creating Initial System with debootstrap=<br /> <br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> apt-get install debootstrap<br /> <br /> mkdir livecd<br /> <br /> debootstrap --arch powerpc squeeze /root/livecd http://ftp.us.debian.org/debian<br /> <br /> # Grab a beer and reverse some PS3 stuff in the meantime :)<br /> <br /> # Enter chroot environment<br /> <br /> mount -t proc none /root/livecd/proc<br /> mount --rbind /dev /root/livecd/dev<br /> LANG=C chroot /root/livecd /bin/bash<br /> <br /> export TERM=xterm-color<br /> <br /> echo &quot;debian&quot; &gt; /etc/hostname<br /> <br /> dpkg-reconfigure tzdata<br /> <br /> # Configure network interfaces<br /> <br /> cat /etc/network/interfaces<br /> ---<br /> auto lo<br /> iface lo inet loopback<br /> <br /> allow-hotplug eth0<br /> iface eth0 inet dhcp<br /> <br /> allow-hotplug wlan0<br /> iface wlan0 inet dhcp<br /> wpa-ssid ssid<br /> wpa-psk psk<br /> -EOF-<br /> <br /> # Configure APT<br /> <br /> cat /etc/apt/sources.list<br /> ---<br /> <br /> deb http://ftp.us.debian.org/debian squeeze main<br /> deb-src http://ftp.us.debian.org/debian squeeze main<br /> <br /> deb http://security.debian.org squeeze/updates main<br /> deb-src http://security.debian.org squeeze/updates main<br /> -EOF-<br /> <br /> aptitude update<br /> <br /> aptitude install locales<br /> dpkg-reconfigure locales<br /> aptitude install console-data<br /> dpkg-reconfigure console-data<br /> <br /> tasksel install standard<br /> aptitude install binutils gcc make git vim openssh-server sudo wireless-tools wpasupplicant libssl-dev libncurses5-dev<br /> aptitude install gcc-spu g++-spu newlib-spu spu-tools<br /> aptitude install parted kpartx cryptsetup libreadline-dev libaio-dev libdevmapper-dev libudev-dev<br /> <br /> # Make SSH server start at boot so we could ssh to our LiveCD<br /> <br /> update-rc.d ssh defaults<br /> <br /> aptitude clean<br /> <br /> rm -f /etc/udev/rules.d/70-persistent-net.rules<br /> <br /> # exit chroot environment<br /> <br /> exit<br /> <br /> # Unmount dev and proc<br /> <br /> umount /root/livecd/dev/shm<br /> umount /root/livecd/dev/pts<br /> umount /root/livecd/dev<br /> umount /root/livecd/proc<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Creating Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root/livecd<br /> mksquashfs * ../root.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Modifying Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root<br /> unsquashfs root.sfs<br /> cd squashfs-root<br /> <br /> # Make your changes<br /> <br /> mksquashfs * ../root-changed.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Linux 3 Kernel=<br /> <br /> * We need a Linux 3 kernel with overlayfs support so we could create a tmpfs over our read-only base filesystem.<br /> * Furthermore, we want to compile PS3 HDD driver as module because in this case we can easily change HDD region flags.<br /> <br /> See my GIT repos:<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-configs<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-34<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-35<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-36<br /> * http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> =Initramfs=<br /> <br /> See my GIT repo: http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> ==BusyBox==<br /> <br /> * We need a couple of user-space applications to mount filesystems, load kernel modules and so on.<br /> * And make sure you compile BusyBox without any library dependencies.<br /> * I compiled my BusyBox executable on PS3 Linux but you could cross-compile it too but then you need a complete PowerPC toolchain with libc.<br /> <br /> &lt;pre&gt;<br /> http://busybox.net/downloads/busybox-1.20.1.tar.bz2<br /> <br /> tar xvjf busybox-1.20.1.tar.bz2<br /> cd busybox-1.20.1<br /> make menuconfig<br /> make<br /> &lt;/pre&gt;<br /> <br /> ==Creating Image==<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> <br /> # Populate initramfs<br /> <br /> mkdir initramfs<br /> cd initramfs<br /> mkdir -p bin dev etc lib/modules/3.6.4 mnt proc sbin sys usr/bin usr/sbin<br /> <br /> cp ~/busybox-1.20.1/busybox bin/<br /> cd bin<br /> ln -sf busybox sh<br /> cd ..<br /> <br /> echo 'sda.* 0:6 0660' &gt;&gt; etc/mdev.conf<br /> echo 'sr[0-9] 0:6 0660 @ln -sf $MDEV cdrom' &gt;&gt; etc/mdev.conf<br /> <br /> cat &gt;etc/modules &lt;&lt;EOF<br /> &gt; fat<br /> &gt; vfat<br /> &gt; isofs<br /> &gt; crc-ccitt<br /> &gt; crc-itu-t<br /> &gt; lzo_compress<br /> &gt; udf<br /> &gt; squashfs<br /> &gt; overlayfs<br /> &gt; ps3_gelic<br /> &gt; ps3stor_lib<br /> &gt; sg<br /> &gt; ps3rom<br /> &gt; usb-common<br /> &gt; usbcore<br /> &gt; ehci-hcd<br /> &gt; ohci-hcd<br /> &gt; usb-storage<br /> &gt; EOF<br /> <br /> for mod in fat vfat isofs crc-ccitt crc-itu-t lzo_compress udf squashfs overlayfs \<br /> ps3_gelic ps3stor_lib sg ps3rom usb-common usbcore ehci-hcd ohci-hcd usb-storage; do<br /> path=`find /home/glevand/linux-3.6.4-build/lib/modules/3.6.4 -name $mod.ko`<br /> cp $path lib/modules/3.6.4/<br /> done<br /> <br /> # Create initramfs<br /> <br /> find . | cpio -H newc -o &gt; ../initramfs.cpio<br /> cd ..<br /> cat initramfs.cpio | gzip &gt; initramfs.cpio.gz<br /> <br /> # Make changes to initramfs<br /> <br /> gunzip initramfs.cpio.gz<br /> mkdir initramfs<br /> cd initramfs<br /> cpio -i -d -H newc --no-absolute-filenames &lt; ../initramfs.cpio<br /> &lt;/syntaxhighlight&gt;}}<br /> =Images=<br /> <br /> * vmlinux-3.6.4.xz: http://www.multiupload.nl/D0PYT6HGC0 (MD5 4b5fdb2995fde82e0f6817a7a86fca2c)<br /> * root.sfs: http://www.multiupload.nl/MWDSBR4OJZ (MD5 3ee12e2d351e0bbe1cd7818be23d8973)<br /> * Tools available on the root filesystem: gcc, spu-gcc, spuisofs, spuldrfs, ps3vuart-tools, ps3sed and all my other PS3 Linux drivers. Everything you need to compile and test various PS3 stuff.<br /> * In case someone still hasn't figured it out yet, password for root is root and password for glevand is glevand :)<br /> * I enabled DHCP on Ethernet.<br /> * You could use WLAN too but for that you have to modify the root filesystem and configure your SSID and PSK in /etc/network/interfaces.<br /> <br /> ==USB==<br /> <br /> * Your USB drive should be formatted with FAT32 filesystem.<br /> * initramfs-usb.cpio.gz: http://www.multiupload.nl/Y084SCQBL3 (MD5 f94b6aec2e5fbbb26f7d466165071469)<br /> * Create '''debianlive''' directory on your USB drive.<br /> * Put vmlinux-3.6.4 (extract xz archive), initramfs.cpio.gz and root.sfs into this directory.<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> $ ls -l /mnt/usb/debianlive/<br /> total 257696<br /> -rwxr-xr-x 1 root root 6746154 Aug 18 17:44 initramfs.cpio.gz<br /> -rwxr-xr-x 1 root root 249835520 Aug 18 17:15 root.sfs<br /> -rwxr-xr-x 1 root root 7288832 Aug 18 17:31 vmlinux-3.6.4<br /> $ ls -l /mnt/usb/<br /> -rwxr-xr-x 1 root root 188 Aug 18 17:30 kboot.conf<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> * And create kboot.conf in the root directory of your USB drive with this content:<br /> <br /> &lt;pre&gt;<br /> debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz<br /> &lt;/pre&gt;<br /> <br /> ==CDROM==<br /> <br /> (files seem missing)<br /> <br /> * initramfs-cdrom.cpio.gz: http://www.multiupload.nl/SA9YK1HFK0 (MD5 f71f8667dc52540136f90a95d7111efc)<br /> * debianlive.iso: http://www.multiupload.nl/TW41UIVAGV (MD5 eeba4fa3428c5d687bada3fd975ea9dd)<br /> * https://www.sendspace.com/file/2negnt (added missing link to debianlive)<br /> * https://mega.nz/#!k1sTXI4a!ANmRDBVYmEdaToauoePNSKvoDl7GXGw0ORNN9ZM0Tfo<br /> * https://www.sendspace.com/file/f8wnpe<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> mkdir -p iso/debianlive<br /> cp root.sfs initramfs.cpio.gz vmlinux-3.6.4 iso/debianlive<br /> echo &quot;debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz&quot; &gt; iso/kboot.conf<br /> cd iso<br /> mkisofs -R -J -l -o ../debianlive.iso .<br /> cd ..<br /> <br /> sudo cdrecord -v dev=/dev/sr0 blank=fast<br /> sudo cdrecord -v dev=/dev/sr0 debianlive.iso<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Links=<br /> <br /> * http://securityfocus.eu/?p=149<br /> <br /> <br /> <br /> {{Linux}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Debian_LiveCD&diff=47432 Debian LiveCD 2017-12-02T16:32:01Z <p>93.108.187.41: /* CDROM */</p> <hr /> <div>[[Category:OtherOS]]<br /> <br /> =Introduction=<br /> <br /> * Sometimes we need to boot Linux without HDD e.g. if you want to experiment with HDD encryption, enable/disable it without causing damage to your data. For such cases we need a LiveCD which doesn't mount HDD at boot.<br /> <br /> =Creating Initial System with debootstrap=<br /> <br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> apt-get install debootstrap<br /> <br /> mkdir livecd<br /> <br /> debootstrap --arch powerpc squeeze /root/livecd http://ftp.us.debian.org/debian<br /> <br /> # Grab a beer and reverse some PS3 stuff in the meantime :)<br /> <br /> # Enter chroot environment<br /> <br /> mount -t proc none /root/livecd/proc<br /> mount --rbind /dev /root/livecd/dev<br /> LANG=C chroot /root/livecd /bin/bash<br /> <br /> export TERM=xterm-color<br /> <br /> echo &quot;debian&quot; &gt; /etc/hostname<br /> <br /> dpkg-reconfigure tzdata<br /> <br /> # Configure network interfaces<br /> <br /> cat /etc/network/interfaces<br /> ---<br /> auto lo<br /> iface lo inet loopback<br /> <br /> allow-hotplug eth0<br /> iface eth0 inet dhcp<br /> <br /> allow-hotplug wlan0<br /> iface wlan0 inet dhcp<br /> wpa-ssid ssid<br /> wpa-psk psk<br /> -EOF-<br /> <br /> # Configure APT<br /> <br /> cat /etc/apt/sources.list<br /> ---<br /> <br /> deb http://ftp.us.debian.org/debian squeeze main<br /> deb-src http://ftp.us.debian.org/debian squeeze main<br /> <br /> deb http://security.debian.org squeeze/updates main<br /> deb-src http://security.debian.org squeeze/updates main<br /> -EOF-<br /> <br /> aptitude update<br /> <br /> aptitude install locales<br /> dpkg-reconfigure locales<br /> aptitude install console-data<br /> dpkg-reconfigure console-data<br /> <br /> tasksel install standard<br /> aptitude install binutils gcc make git vim openssh-server sudo wireless-tools wpasupplicant libssl-dev libncurses5-dev<br /> aptitude install gcc-spu g++-spu newlib-spu spu-tools<br /> aptitude install parted kpartx cryptsetup libreadline-dev libaio-dev libdevmapper-dev libudev-dev<br /> <br /> # Make SSH server start at boot so we could ssh to our LiveCD<br /> <br /> update-rc.d ssh defaults<br /> <br /> aptitude clean<br /> <br /> rm -f /etc/udev/rules.d/70-persistent-net.rules<br /> <br /> # exit chroot environment<br /> <br /> exit<br /> <br /> # Unmount dev and proc<br /> <br /> umount /root/livecd/dev/shm<br /> umount /root/livecd/dev/pts<br /> umount /root/livecd/dev<br /> umount /root/livecd/proc<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Creating Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root/livecd<br /> mksquashfs * ../root.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Modifying Root Filesystem=<br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> cd /root<br /> unsquashfs root.sfs<br /> cd squashfs-root<br /> <br /> # Make your changes<br /> <br /> mksquashfs * ../root-changed.sfs<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Linux 3 Kernel=<br /> <br /> * We need a Linux 3 kernel with overlayfs support so we could create a tmpfs over our read-only base filesystem.<br /> * Furthermore, we want to compile PS3 HDD driver as module because in this case we can easily change HDD region flags.<br /> <br /> See my GIT repos:<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-configs<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-34<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-35<br /> * http://gitorious.ps3dev.net/ps3linux/kernel-patches-36<br /> * http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> =Initramfs=<br /> <br /> See my GIT repo: http://gitorious.ps3dev.net/ps3linux/livecd<br /> <br /> ==BusyBox==<br /> <br /> * We need a couple of user-space applications to mount filesystems, load kernel modules and so on.<br /> * And make sure you compile BusyBox without any library dependencies.<br /> * I compiled my BusyBox executable on PS3 Linux but you could cross-compile it too but then you need a complete PowerPC toolchain with libc.<br /> <br /> &lt;pre&gt;<br /> http://busybox.net/downloads/busybox-1.20.1.tar.bz2<br /> <br /> tar xvjf busybox-1.20.1.tar.bz2<br /> cd busybox-1.20.1<br /> make menuconfig<br /> make<br /> &lt;/pre&gt;<br /> <br /> ==Creating Image==<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> <br /> # Populate initramfs<br /> <br /> mkdir initramfs<br /> cd initramfs<br /> mkdir -p bin dev etc lib/modules/3.6.4 mnt proc sbin sys usr/bin usr/sbin<br /> <br /> cp ~/busybox-1.20.1/busybox bin/<br /> cd bin<br /> ln -sf busybox sh<br /> cd ..<br /> <br /> echo 'sda.* 0:6 0660' &gt;&gt; etc/mdev.conf<br /> echo 'sr[0-9] 0:6 0660 @ln -sf $MDEV cdrom' &gt;&gt; etc/mdev.conf<br /> <br /> cat &gt;etc/modules &lt;&lt;EOF<br /> &gt; fat<br /> &gt; vfat<br /> &gt; isofs<br /> &gt; crc-ccitt<br /> &gt; crc-itu-t<br /> &gt; lzo_compress<br /> &gt; udf<br /> &gt; squashfs<br /> &gt; overlayfs<br /> &gt; ps3_gelic<br /> &gt; ps3stor_lib<br /> &gt; sg<br /> &gt; ps3rom<br /> &gt; usb-common<br /> &gt; usbcore<br /> &gt; ehci-hcd<br /> &gt; ohci-hcd<br /> &gt; usb-storage<br /> &gt; EOF<br /> <br /> for mod in fat vfat isofs crc-ccitt crc-itu-t lzo_compress udf squashfs overlayfs \<br /> ps3_gelic ps3stor_lib sg ps3rom usb-common usbcore ehci-hcd ohci-hcd usb-storage; do<br /> path=`find /home/glevand/linux-3.6.4-build/lib/modules/3.6.4 -name $mod.ko`<br /> cp $path lib/modules/3.6.4/<br /> done<br /> <br /> # Create initramfs<br /> <br /> find . | cpio -H newc -o &gt; ../initramfs.cpio<br /> cd ..<br /> cat initramfs.cpio | gzip &gt; initramfs.cpio.gz<br /> <br /> # Make changes to initramfs<br /> <br /> gunzip initramfs.cpio.gz<br /> mkdir initramfs<br /> cd initramfs<br /> cpio -i -d -H newc --no-absolute-filenames &lt; ../initramfs.cpio<br /> &lt;/syntaxhighlight&gt;}}<br /> =Images=<br /> <br /> * vmlinux-3.6.4.xz: http://www.multiupload.nl/D0PYT6HGC0 (MD5 4b5fdb2995fde82e0f6817a7a86fca2c)<br /> * root.sfs: http://www.multiupload.nl/MWDSBR4OJZ (MD5 3ee12e2d351e0bbe1cd7818be23d8973)<br /> * Tools available on the root filesystem: gcc, spu-gcc, spuisofs, spuldrfs, ps3vuart-tools, ps3sed and all my other PS3 Linux drivers. Everything you need to compile and test various PS3 stuff.<br /> * In case someone still hasn't figured it out yet, password for root is root and password for glevand is glevand :)<br /> * I enabled DHCP on Ethernet.<br /> * You could use WLAN too but for that you have to modify the root filesystem and configure your SSID and PSK in /etc/network/interfaces.<br /> <br /> ==USB==<br /> <br /> * Your USB drive should be formatted with FAT32 filesystem.<br /> * initramfs-usb.cpio.gz: http://www.multiupload.nl/Y084SCQBL3 (MD5 f94b6aec2e5fbbb26f7d466165071469)<br /> * Create '''debianlive''' directory on your USB drive.<br /> * Put vmlinux-3.6.4 (extract xz archive), initramfs.cpio.gz and root.sfs into this directory.<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> $ ls -l /mnt/usb/debianlive/<br /> total 257696<br /> -rwxr-xr-x 1 root root 6746154 Aug 18 17:44 initramfs.cpio.gz<br /> -rwxr-xr-x 1 root root 249835520 Aug 18 17:15 root.sfs<br /> -rwxr-xr-x 1 root root 7288832 Aug 18 17:31 vmlinux-3.6.4<br /> $ ls -l /mnt/usb/<br /> -rwxr-xr-x 1 root root 188 Aug 18 17:30 kboot.conf<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> * And create kboot.conf in the root directory of your USB drive with this content:<br /> <br /> &lt;pre&gt;<br /> debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz<br /> &lt;/pre&gt;<br /> <br /> ==CDROM==<br /> <br /> (files seem missing)<br /> <br /> * initramfs-cdrom.cpio.gz: http://www.multiupload.nl/SA9YK1HFK0 (MD5 f71f8667dc52540136f90a95d7111efc)<br /> * debianlive.iso: http://www.multiupload.nl/TW41UIVAGV (MD5 eeba4fa3428c5d687bada3fd975ea9dd)<br /> * https://www.sendspace.com/file/2negnt (added missing link to debianlive)<br /> * https://mega.nz/#!k1sTXI4a!ANmRDBVYmEdaToauoePNSKvoDl7GXGw0ORNN9ZM0Tfo<br /> <br /> {{Keyboard|content=&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> mkdir -p iso/debianlive<br /> cp root.sfs initramfs.cpio.gz vmlinux-3.6.4 iso/debianlive<br /> echo &quot;debianlive=/debianlive/vmlinux-3.6.4 initrd=/debianlive/initramfs.cpio.gz&quot; &gt; iso/kboot.conf<br /> cd iso<br /> mkisofs -R -J -l -o ../debianlive.iso .<br /> cd ..<br /> <br /> sudo cdrecord -v dev=/dev/sr0 blank=fast<br /> sudo cdrecord -v dev=/dev/sr0 debianlive.iso<br /> &lt;/syntaxhighlight&gt;}}<br /> <br /> =Links=<br /> <br /> * http://securityfocus.eu/?p=149<br /> <br /> <br /> <br /> {{Linux}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=47313 Keys 2017-11-21T13:52:35Z <p>93.108.187.41: /* Arcade ATA Decryption Key 2 */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key !! obfuscated key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt; || <br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt; || <br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt; || <br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt; || <br /> |-<br /> | root || 4.20-{{latest}} || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt; || &lt;code&gt;8B77B209CD58C688CF5E38C8FAFD781B&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Root crypto spu keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! version !! erk !! riv<br /> |-<br /> | 4.20-{{latest}} || &lt;code&gt;E044C1E29C53FEF2E064E31207D09D48676719789D59E5C1F004D002390F2360&lt;/code&gt;&lt;br&gt;&lt;code&gt;8350EBCCCA16A69A08E2A813F18B92EF688B163CB6C4781F0285AEAD4DAB0FD2&lt;/code&gt;&lt;br&gt;&lt;code&gt;555A7B10D87DA8C9257136546E1A6A33782DC8C1B1A888A3FB2000EFBC12DE7F&lt;/code&gt;&lt;br&gt;&lt;code&gt;FC6EC40EC3782C8C53625B96E72334E67073EC2C0395A5DB0A1CACA119E61A86&lt;/code&gt;&lt;br&gt;&lt;code&gt;ADA4401ADD1CC764A0C2DB4D58E13F8B23515AB750DCED2BAE626CCE7FD07242&lt;/code&gt;&lt;br&gt;&lt;code&gt;E2BF4D2503282798E4A736ACC388412D&lt;/code&gt; || &lt;code&gt;20385B4B1819FD8E691BBEF17001392B&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60-3.61 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60-3.61 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65-3.66 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70-3.74 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.00-4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.20-{{latest}} || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> Note: key1/iv1 used for unscramble scrambled keys, key2/iv2 used for unscramble scrambled ivs<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60-3.61 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.20-{{latest}} || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;760EA11735B587072EDD4FFD0BD31DD3BE9AB82188A344C81E7E4710F9607779&lt;/code&gt; || &lt;code&gt;AC559E2326390686B064B6AC45753117&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.20-{{latest}} || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.20-{{latest}} || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.20-{{latest}} || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.20-{{latest}} || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: //invalid key type<br /> 1: //SRK (dynamic key)<br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75) //ss::sc_key::series_key<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75) //ss::sc_key::series_key2<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56) //ss::sc_key::key_for_master<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75) //ss::sc_key::key_for_master.2 (new one)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: //encrypted keyseed_for_srk2 (perconsole dynamic key)<br /> 6: //encrypted seed_for_backup (perconsole dynamic key)<br /> 7: //encrypted sherwood_ss_seed (perconsole dynamic key)<br /> 8: //encrypted ss_seed_one_more (perconsole dynamic key)<br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cbc128 key, used with zero iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj&lt;br&gt;<br /> ivs_3des also exists in lv2_kernel, as well as ivs_aes<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> psp2_gpkg_key0: E31A70C9CE1DD72BF3C0622963F2ECCB<br /> psp2_gpkg_key1: 423ACA3A2BD5649F9686ABAD6FD8801F<br /> psp2_gpkg_key2: AF07FD59652527BAF13389668B17D9EA<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> location: lv2_kernel<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> private key enc:<br /> 05974EA73D2019A1FE03A7F685DCBD5A7D2F07E5BF15DA291B31586C8840C75B<br /> private key dec:<br /> 004FC12D7464FBFB3E0D5754016AE6867A256C16EA<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == Arcade ATA Decryption Key 2 ==<br /> Key 5F20A21ED12FF6425B62FDE0D1881C845F20A21ED12FF6425B62FDE0D1881C84<br /> <br /> * Key used for System 369<br /> <br /> == Arcade EncDec Decryption Key ==<br /> Key 7B07E0D651130EB443146836DB89B5AB230976E1E842D4F44A5E257615991BA1<br /> <br /> * Key used for System 369 (VFlash)<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Location: lv2_kernel.self<br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys (External)==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> * Location: lv2_kernel.self<br /> * Used for popup ads<br /> <br /> == SCEI_AD_SIGN RSA Keys (Internal) ==<br /> <br /> pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF<br /> exponent : 010001<br /> priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49<br /> p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9<br /> q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67<br /> dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9<br /> dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F<br /> invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE<br /> <br /> * Location: lv2_kernel.self<br /> * Used for popup ads.<br /> <br /> == Trophy RSA Keys ==<br /> <br /> pub : CA30CEE59BF19E041F6F02C54AE42CD6769185E157AB8659B70DCEC0C3EE6039FF952FD9767D35474B11BB5514205C553864F77BD4DA899B30110B0EA4F8AD33FBE0350E085B2A92A7D327978110AAB95085730235408156707C3B2238F978BFF4F308063809AEAFB2F9AEC62E1968CFF58B9BA834B3588C92C8411C548BFC49<br /> exponent : 010001<br /> trns_pub : CE8A7F561F08EC50EAD12C1CD5EA95F914574E52942E1D25D944319704ADC3E87FDE0E0451EDA05C347BBA584E7572F9660D18014E444C46C8EE8ADF10F4A1345FE51EF42D94A1A9DE692CE99702AAC4D4C5E528EFADBA5B53B20A50B686D084307EC3EABB61157E5E00A96A374FBF5C570B804D821C17573C1C00ACF29CF5E7<br /> SceNpTrophyXmlShaHmacKey : 6AC0B3FB1EBB4FB7BCC2A00DA3A2A4BDBCB788EC456748CC86CD9D09EF37937F6EE31167778E414E9B711BE9D8CBB5F8956E454EE94A46C39DC4FF0D090B92B7<br /> <br /> * inside np_trophy_util.sprx<br /> <br /> == CFK1 Master Keys ==<br /> <br /> INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8<br /> INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d<br /> EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da<br /> EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e<br /> NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185<br /> NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c<br /> <br /> * Location: lv2_kernel.self<br /> Added in 3.10. Seems to be Cinavia related?<br /> <br /> == PME Vectors ==<br /> reset external decrem syscall<br /> 482D2D34 482A4F70 482A509C 482A50E4 &lt;- internal<br /> 48202658 482023D0 482024FC 48202544 &lt;- external<br /> 48079C94 4806E624 4806E750 4806E798 &lt;- mambo_internal<br /> <br /> * these denote the location of several things inside lv1. TOC is in the third entry<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven {{SD}}&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BBDF2959EB4AAEF5882BE11FF033B77FF9FD55B1F30819D42154F6B069C14FEF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;241C0CC5A8591B50EF460EE3E50116C3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0E140FBAD23F1B236C6AD0623A7C2C6366AEDA66380860A9D727A56FD681F644EF22A7E07979A1BE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x33&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === AppLdr hmac key ===<br /> &lt;code&gt;A09B58A612B9F4C13451A1B81C94ABF8423ED76A96271A722394F0DD042BA2CAA41A567177A8B500235C74495842BF2007FAF274CC81091AD57AF7264A60E2CE&lt;/code&gt;<br /> <br /> Note: Used for LV2 memory check.<br /> <br /> This key was implemented since 3.55.<br /> <br /> LV1 used lv2ldr to generate the hash when it loads LV2 then used appldr to verify generated hash when it loads self file.<br /> <br /> Location: lv2ldr, appldr inside lv0 (3.61+) outside lv0 (3.55,3.60)<br /> <br /> Note2: unlike some people have stated, there isn't only one section being verified.&lt;br&gt;<br /> 7 sections are verified, and these are:<br /> core, text, rodata, ctors, toc1, opd and finally toc<br /> <br /> Note3: hash value is stored in .bss segment of lv1 and transfered to spu through the SharedLS.<br /> typedef struct {<br /> uint64_t lv2_mem_offset;<br /> uint64_t hashed_data_size;<br /> uint8_t[0x14] hmac_hash;<br /> uint8_t[0x0C] pad;<br /> } LV2_MEMORY_PROTECTION_ARGUMENTS;<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://img24.imageshack.us/img24/9083/snapshote.png&lt;/span&gt;&lt;br&gt;<br /> https://i.imgur.com/1UN7rOi.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == LV2 Kernel 3Des Key ==<br /> <br /> 57C3E792E8D03DC4D2D72DFA4F81FB2889170959<br /> <br /> * used in conjuction with ivs_3des<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Public Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> == PEmuCoreLib Key (3DES) ==<br /> EF690EC0E0BFA41F08455BD038EB8762DA3923EF9C61B930 erk<br /> 2DEE8950969112D9 riv<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> * Location: explore_plugin.sprx<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==TMDB Key==<br /> <br /> sha1-hmac key<br /> F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197CF1AED3B7E9671EEB56CA6753C2E6B0<br /> <br /> * Location: explore_plugin.sprx<br /> Used to generate URLs to obtain Title infos.<br /> For example, title_id: BLES01133<br /> seed will contain BLES01133_00<br /> openssl dgst -mac hmac -macopt hexkey:F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197<br /> CF1AED3B7E9671EEB56CA6753C2E6B0 -sha1 seed<br /> HMAC-SHA1(seed.bin)= 93ec11e04b137b433a9c867603e64660782a762e<br /> <br /> URL will be: http://tmdb.np.dl.playstation.net/tmdb/BLES01133_00_93EC11E04B137B433A9C867603E64660782A762E/BLES01133_00.xml<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> | <br /> | DES Sbox 1<br /> 01 01 04 00 00 00 00 00 00 01 00 00 01 01 04 04<br /> 01 01 00 04 00 01 04 04 00 00 00 04 00 01 00 00<br /> 00 00 04 00 01 01 04 00 01 01 04 04 00 00 04 00<br /> 01 00 04 04 01 01 00 04 01 00 00 00 00 00 00 04<br /> 00 00 04 04 01 00 04 00 01 00 04 00 00 01 04 00<br /> 00 01 04 00 01 01 00 00 01 01 00 00 01 00 04 04<br /> 00 01 00 04 01 00 00 04 01 00 00 04 00 01 00 04<br /> 00 00 00 00 00 00 04 04 00 01 04 04 01 00 00 00<br /> 00 01 00 00 01 01 04 04 00 00 00 04 01 01 00 00<br /> 01 01 04 00 01 00 00 00 01 00 00 00 00 00 04 00<br /> 01 01 00 04 00 01 00 00 00 01 04 00 01 00 00 04<br /> 00 00 04 00 00 00 00 04 01 00 04 04 00 01 04 04<br /> 01 01 04 04 00 01 00 04 01 01 00 00 01 00 04 04<br /> 01 00 00 04 00 00 04 04 00 01 04 04 01 01 04 00<br /> 00 00 04 04 01 00 04 00 01 00 04 00 00 00 00 00<br /> 00 01 00 04 00 01 04 00 00 00 00 00 01 01 00 04<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=47312 Keys 2017-11-21T13:50:48Z <p>93.108.187.41: /* Arcade ATA Decryption Key */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key !! obfuscated key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt; || <br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt; || <br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt; || <br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt; || <br /> |-<br /> | root || 4.20-{{latest}} || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt; || &lt;code&gt;8B77B209CD58C688CF5E38C8FAFD781B&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Root crypto spu keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! version !! erk !! riv<br /> |-<br /> | 4.20-{{latest}} || &lt;code&gt;E044C1E29C53FEF2E064E31207D09D48676719789D59E5C1F004D002390F2360&lt;/code&gt;&lt;br&gt;&lt;code&gt;8350EBCCCA16A69A08E2A813F18B92EF688B163CB6C4781F0285AEAD4DAB0FD2&lt;/code&gt;&lt;br&gt;&lt;code&gt;555A7B10D87DA8C9257136546E1A6A33782DC8C1B1A888A3FB2000EFBC12DE7F&lt;/code&gt;&lt;br&gt;&lt;code&gt;FC6EC40EC3782C8C53625B96E72334E67073EC2C0395A5DB0A1CACA119E61A86&lt;/code&gt;&lt;br&gt;&lt;code&gt;ADA4401ADD1CC764A0C2DB4D58E13F8B23515AB750DCED2BAE626CCE7FD07242&lt;/code&gt;&lt;br&gt;&lt;code&gt;E2BF4D2503282798E4A736ACC388412D&lt;/code&gt; || &lt;code&gt;20385B4B1819FD8E691BBEF17001392B&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60-3.61 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60-3.61 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65-3.66 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70-3.74 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.00-4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.20-{{latest}} || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> Note: key1/iv1 used for unscramble scrambled keys, key2/iv2 used for unscramble scrambled ivs<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60-3.61 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.20-{{latest}} || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;760EA11735B587072EDD4FFD0BD31DD3BE9AB82188A344C81E7E4710F9607779&lt;/code&gt; || &lt;code&gt;AC559E2326390686B064B6AC45753117&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.20-{{latest}} || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.20-{{latest}} || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.20-{{latest}} || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.20-{{latest}} || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: //invalid key type<br /> 1: //SRK (dynamic key)<br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75) //ss::sc_key::series_key<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75) //ss::sc_key::series_key2<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56) //ss::sc_key::key_for_master<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75) //ss::sc_key::key_for_master.2 (new one)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: //encrypted keyseed_for_srk2 (perconsole dynamic key)<br /> 6: //encrypted seed_for_backup (perconsole dynamic key)<br /> 7: //encrypted sherwood_ss_seed (perconsole dynamic key)<br /> 8: //encrypted ss_seed_one_more (perconsole dynamic key)<br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cbc128 key, used with zero iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj&lt;br&gt;<br /> ivs_3des also exists in lv2_kernel, as well as ivs_aes<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> psp2_gpkg_key0: E31A70C9CE1DD72BF3C0622963F2ECCB<br /> psp2_gpkg_key1: 423ACA3A2BD5649F9686ABAD6FD8801F<br /> psp2_gpkg_key2: AF07FD59652527BAF13389668B17D9EA<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> location: lv2_kernel<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> private key enc:<br /> 05974EA73D2019A1FE03A7F685DCBD5A7D2F07E5BF15DA291B31586C8840C75B<br /> private key dec:<br /> 004FC12D7464FBFB3E0D5754016AE6867A256C16EA<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == Arcade ATA Decryption Key 2 ==<br /> Key 5F20A21ED12FF6425B62FDE0D1881C845F20A21ED12FF6425B62FDE0D1881C84<br /> <br /> * Key used for System 369<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Location: lv2_kernel.self<br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys (External)==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> * Location: lv2_kernel.self<br /> * Used for popup ads<br /> <br /> == SCEI_AD_SIGN RSA Keys (Internal) ==<br /> <br /> pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF<br /> exponent : 010001<br /> priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49<br /> p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9<br /> q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67<br /> dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9<br /> dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F<br /> invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE<br /> <br /> * Location: lv2_kernel.self<br /> * Used for popup ads.<br /> <br /> == Trophy RSA Keys ==<br /> <br /> pub : CA30CEE59BF19E041F6F02C54AE42CD6769185E157AB8659B70DCEC0C3EE6039FF952FD9767D35474B11BB5514205C553864F77BD4DA899B30110B0EA4F8AD33FBE0350E085B2A92A7D327978110AAB95085730235408156707C3B2238F978BFF4F308063809AEAFB2F9AEC62E1968CFF58B9BA834B3588C92C8411C548BFC49<br /> exponent : 010001<br /> trns_pub : CE8A7F561F08EC50EAD12C1CD5EA95F914574E52942E1D25D944319704ADC3E87FDE0E0451EDA05C347BBA584E7572F9660D18014E444C46C8EE8ADF10F4A1345FE51EF42D94A1A9DE692CE99702AAC4D4C5E528EFADBA5B53B20A50B686D084307EC3EABB61157E5E00A96A374FBF5C570B804D821C17573C1C00ACF29CF5E7<br /> SceNpTrophyXmlShaHmacKey : 6AC0B3FB1EBB4FB7BCC2A00DA3A2A4BDBCB788EC456748CC86CD9D09EF37937F6EE31167778E414E9B711BE9D8CBB5F8956E454EE94A46C39DC4FF0D090B92B7<br /> <br /> * inside np_trophy_util.sprx<br /> <br /> == CFK1 Master Keys ==<br /> <br /> INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8<br /> INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d<br /> EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da<br /> EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e<br /> NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185<br /> NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c<br /> <br /> * Location: lv2_kernel.self<br /> Added in 3.10. Seems to be Cinavia related?<br /> <br /> == PME Vectors ==<br /> reset external decrem syscall<br /> 482D2D34 482A4F70 482A509C 482A50E4 &lt;- internal<br /> 48202658 482023D0 482024FC 48202544 &lt;- external<br /> 48079C94 4806E624 4806E750 4806E798 &lt;- mambo_internal<br /> <br /> * these denote the location of several things inside lv1. TOC is in the third entry<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven {{SD}}&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BBDF2959EB4AAEF5882BE11FF033B77FF9FD55B1F30819D42154F6B069C14FEF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;241C0CC5A8591B50EF460EE3E50116C3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0E140FBAD23F1B236C6AD0623A7C2C6366AEDA66380860A9D727A56FD681F644EF22A7E07979A1BE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x33&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === AppLdr hmac key ===<br /> &lt;code&gt;A09B58A612B9F4C13451A1B81C94ABF8423ED76A96271A722394F0DD042BA2CAA41A567177A8B500235C74495842BF2007FAF274CC81091AD57AF7264A60E2CE&lt;/code&gt;<br /> <br /> Note: Used for LV2 memory check.<br /> <br /> This key was implemented since 3.55.<br /> <br /> LV1 used lv2ldr to generate the hash when it loads LV2 then used appldr to verify generated hash when it loads self file.<br /> <br /> Location: lv2ldr, appldr inside lv0 (3.61+) outside lv0 (3.55,3.60)<br /> <br /> Note2: unlike some people have stated, there isn't only one section being verified.&lt;br&gt;<br /> 7 sections are verified, and these are:<br /> core, text, rodata, ctors, toc1, opd and finally toc<br /> <br /> Note3: hash value is stored in .bss segment of lv1 and transfered to spu through the SharedLS.<br /> typedef struct {<br /> uint64_t lv2_mem_offset;<br /> uint64_t hashed_data_size;<br /> uint8_t[0x14] hmac_hash;<br /> uint8_t[0x0C] pad;<br /> } LV2_MEMORY_PROTECTION_ARGUMENTS;<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://img24.imageshack.us/img24/9083/snapshote.png&lt;/span&gt;&lt;br&gt;<br /> https://i.imgur.com/1UN7rOi.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == LV2 Kernel 3Des Key ==<br /> <br /> 57C3E792E8D03DC4D2D72DFA4F81FB2889170959<br /> <br /> * used in conjuction with ivs_3des<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Public Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> == PEmuCoreLib Key (3DES) ==<br /> EF690EC0E0BFA41F08455BD038EB8762DA3923EF9C61B930 erk<br /> 2DEE8950969112D9 riv<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> * Location: explore_plugin.sprx<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==TMDB Key==<br /> <br /> sha1-hmac key<br /> F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197CF1AED3B7E9671EEB56CA6753C2E6B0<br /> <br /> * Location: explore_plugin.sprx<br /> Used to generate URLs to obtain Title infos.<br /> For example, title_id: BLES01133<br /> seed will contain BLES01133_00<br /> openssl dgst -mac hmac -macopt hexkey:F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197<br /> CF1AED3B7E9671EEB56CA6753C2E6B0 -sha1 seed<br /> HMAC-SHA1(seed.bin)= 93ec11e04b137b433a9c867603e64660782a762e<br /> <br /> URL will be: http://tmdb.np.dl.playstation.net/tmdb/BLES01133_00_93EC11E04B137B433A9C867603E64660782A762E/BLES01133_00.xml<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> | <br /> | DES Sbox 1<br /> 01 01 04 00 00 00 00 00 00 01 00 00 01 01 04 04<br /> 01 01 00 04 00 01 04 04 00 00 00 04 00 01 00 00<br /> 00 00 04 00 01 01 04 00 01 01 04 04 00 00 04 00<br /> 01 00 04 04 01 01 00 04 01 00 00 00 00 00 00 04<br /> 00 00 04 04 01 00 04 00 01 00 04 00 00 01 04 00<br /> 00 01 04 00 01 01 00 00 01 01 00 00 01 00 04 04<br /> 00 01 00 04 01 00 00 04 01 00 00 04 00 01 00 04<br /> 00 00 00 00 00 00 04 04 00 01 04 04 01 00 00 00<br /> 00 01 00 00 01 01 04 04 00 00 00 04 01 01 00 00<br /> 01 01 04 00 01 00 00 00 01 00 00 00 00 00 04 00<br /> 01 01 00 04 00 01 00 00 00 01 04 00 01 00 00 04<br /> 00 00 04 00 00 00 00 04 01 00 04 04 00 01 04 04<br /> 01 01 04 04 00 01 00 04 01 01 00 00 01 00 04 04<br /> 01 00 00 04 00 00 04 04 00 01 04 04 01 01 04 00<br /> 00 00 04 04 01 00 04 00 01 00 04 00 00 00 00 00<br /> 00 01 00 04 00 01 04 00 00 00 00 00 01 01 00 04<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=3.60_ARC&diff=47038 3.60 ARC 2017-10-31T11:36:58Z <p>93.108.187.41: /* PUP Hashes */</p> <hr /> <div>= Changes =<br /> ...<br /> <br /> = Download =<br /> * https://mega.nz/#F!Ns1X3AzD!Cn7wX6FF2mmwtujVkPSyMw<br /> <br /> = PUP Hashes =<br /> MD5::49A1F22F7ADAF92C6E6E4C3661786DC4 | SHA1::07ACD06C054806740AD441993E9D58255B0A58FB<br /> <br /> = Pup Information =<br /> <br /> {{System Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=4.30_DEX&diff=45832 4.30 DEX 2017-08-26T15:18:02Z <p>93.108.187.41: /* Changes */</p> <hr /> <div>Released: October 17, 2012<br /> <br /> {{cex2dexwarning}}<br /> <br /> Miralatijera released his patch to still have DEX converts running on 4.30 DEX as follow: http://pastie.org/private/emwfwuoizwvq8tlirp6a<br /> <br /> = Changes =<br /> ...<br /> <br /> = Changes in LV2 Kernel since 4.25DEX =<br /> * syscall_725<br /> * sys_fs_mount<br /> * syscall_836 <br /> * syscall_875<br /> * sys_ss_media_id<br /> <br /> = Download =<br /> * https://yadi.sk/d/-Y-OKDm5mJjxq<br /> * &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://www.multiupload.nl/0D1U05BJXW&lt;/span&gt;<br /> * &lt;span style=&quot;text-decoration: line-through;&quot;&gt;https://mega.co.nz/#!htRFVCJB!bgaM4iYR_bP_Cr8sbJX_bE7z--U2MlG56ifyR0TIqHs&lt;/span&gt;<br /> * http://mir.cr/0TXKVB61<br /> * &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://ps3devwiki.com/files/firmware/OFW-DEX/4.30/PS3UPDAT.PUP&lt;/span&gt;<br /> * &lt;span style=&quot;text-decoration: line-through;&quot;&gt;http://vdisk.weibo.com/s/qnBoe&lt;/span&gt;<br /> <br /> = PUP Hashes =<br /> MD5::2B8F823526634F1D04A7F61261EEE850 | SHA1::DD96D7D4DA85F0AAB41F7B82D348572B889A39C1 | CRC32::BDCAD908 | CRC16::04A1 | HMAC_SHA1::0xF1CA59DB50C7D9B86175B95EBBF1A39D0F1AB3AE<br /> <br /> = Pup Information =<br /> &lt;pre&gt;PUP file information<br /> Package version: 1<br /> Image version: 99999<br /> File count: 9<br /> Header length: 656<br /> Data length: 186813495<br /> PUP file hash : F1CA59DB50C7D9B86175B95EBBF1A39D0F1AB3AE<br /> File 0<br /> Entry id: 0x100<br /> Filename : version.txt<br /> Data offset: 0x290<br /> Data length: 5<br /> File hash : 1E49F1F42C18AC829E29A1CABA8404073A8631FE<br /> File 1<br /> Entry id: 0x101<br /> Filename : license.xml<br /> Data offset: 0x295<br /> Data length: 308970<br /> File hash : 5003EBF1548E8F002545561B74BBF5C470EE92C7<br /> File 2<br /> Entry id: 0x103<br /> Filename : update_flags.txt<br /> Data offset: 0x4B97F<br /> Data length: 5<br /> File hash : 65A0A6DA7FDB7F7A93C50F2439F6D5FE4C55AF74<br /> File 3<br /> Entry id: 0x200<br /> Filename : ps3swu.self<br /> Data offset: 0x4B984<br /> Data length: 5669536<br /> File hash : 401FD78D850CF1EB797A5E4F96FB86BF429E5877<br /> File 4<br /> Entry id: 0x201<br /> Filename : vsh.tar<br /> Data offset: 0x5B3C24<br /> Data length: 10240<br /> File hash : D9B66E0D2845D71A67D76E7907AB06368CE61E08<br /> File 5<br /> Entry id: 0x202<br /> Filename : dots.txt<br /> Data offset: 0x5B6424<br /> Data length: 3<br /> File hash : 1AA4749D0EE0D0AE937FBF73BC4B9ACD352F732A<br /> File 6<br /> Entry id: 0x300<br /> Filename : update_files.tar<br /> Data offset: 0x5B6427<br /> Data length: 175083520<br /> File hash : 884BF69AC877FD054FD3DC92C88AF439FBA32FD6<br /> File 7<br /> Entry id: 0x501<br /> Filename : spkg_hdr.tar<br /> Data offset: 0xACAF427<br /> Data length: 71680<br /> File hash : AA3090A65BBAFFFB306B2FA8EE600C689B6F030F<br /> File 8<br /> Entry id: 0x601<br /> Filename : ps3swu2.self<br /> Data offset: 0xACC0C27<br /> Data length: 5669536<br /> File hash : 1677EC061EDA6AD3D50C12B47599220E931A8552&lt;/pre&gt;<br /> <br /> <br /> <br /> {{System Firmware}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=DES_binaries&diff=45398 DES binaries 2017-07-31T12:58:46Z <p>93.108.187.41: Created page with &quot;These are the binaries that contain DES sbox. = Table of Binaries = *TODO&quot;</p> <hr /> <div>These are the binaries that contain DES sbox.<br /> <br /> = Table of Binaries =<br /> <br /> *TODO</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=44272 Keys 2017-05-26T12:15:35Z <p>93.108.187.41: /* Trophy RSA Keys */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt;<br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt;<br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt;<br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt;<br /> |-<br /> | root || 4.20-4.80 || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.21 || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.21 || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.21 || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.21 || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.21 || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.21 || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: <br /> 1: <br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75)<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75)<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56)<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: <br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Location: lv2_kernel.self<br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys (External)==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> * Location: lv2_kernel.self<br /> * Used for popup ads<br /> <br /> == SCEI_AD_SIGN RSA Keys (Internal) ==<br /> <br /> pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF<br /> exponent : 010001<br /> priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49<br /> p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9<br /> q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67<br /> dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9<br /> dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F<br /> invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE<br /> <br /> * Location: lv2_kernel.self<br /> * Used for popup ads.<br /> <br /> == Trophy RSA Keys ==<br /> <br /> pub : CA30CEE59BF19E041F6F02C54AE42CD6769185E157AB8659B70DCEC0C3EE6039FF952FD9767D35474B11BB5514205C553864F77BD4DA899B30110B0EA4F8AD33FBE0350E085B2A92A7D327978110AAB95085730235408156707C3B2238F978BFF4F308063809AEAFB2F9AEC62E1968CFF58B9BA834B3588C92C8411C548BFC49<br /> exponent : 010001<br /> trns_pub : CE8A7F561F08EC50EAD12C1CD5EA95F914574E52942E1D25D944319704ADC3E87FDE0E0451EDA05C347BBA584E7572F9660D18014E444C46C8EE8ADF10F4A1345FE51EF42D94A1A9DE692CE99702AAC4D4C5E528EFADBA5B53B20A50B686D084307EC3EABB61157E5E00A96A374FBF5C570B804D821C17573C1C00ACF29CF5E7<br /> SceNpTrophyXmlShaHmacKey : 6AC0B3FB1EBB4FB7BCC2A00DA3A2A4BDBCB788EC456748CC86CD9D09EF37937F6EE31167778E414E9B711BE9D8CBB5F8956E454EE94A46C39DC4FF0D090B92B7<br /> <br /> * inside np_trophy_util.sprx<br /> <br /> == CFK1 Master Keys ==<br /> <br /> INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8<br /> INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d<br /> EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da<br /> EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e<br /> NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185<br /> NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c<br /> <br /> * Location: lv2_kernel.self<br /> Added in 3.10. Seems to be Cinavia related?<br /> <br /> == PME Vectors ==<br /> reset external decrem syscall<br /> 482D2D34 482A4F70 482A509C 482A50E4 &lt;- internal<br /> 48202658 482023D0 482024FC 48202544 &lt;- external<br /> 48079C94 4806E624 4806E750 4806E798 &lt;- mambo_internal<br /> <br /> * these denote the location of several things inside lv1. TOC is in the third entry<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> http://img24.imageshack.us/img24/9083/snapshote.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Private Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=44244 Keys 2017-05-24T13:06:09Z <p>93.108.187.41: /* PME Reset Vectors */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt;<br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt;<br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt;<br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt;<br /> |-<br /> | root || 4.20-4.80 || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.21 || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.21 || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.21 || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.21 || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.21 || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.21 || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: <br /> 1: <br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75)<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75)<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56)<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: <br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Location: lv2_kernel.self<br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys (External)==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> * Location: lv2_kernel.self<br /> <br /> == SCEI_AD_SIGN RSA Keys (Internal) ==<br /> <br /> pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF<br /> exponent : 010001<br /> priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49<br /> p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9<br /> q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67<br /> dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9<br /> dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F<br /> invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE<br /> <br /> * Location: lv2_kernel.self<br /> <br /> == CFK1 Master Keys ==<br /> <br /> INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8<br /> INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d<br /> EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da<br /> EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e<br /> NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185<br /> NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c<br /> <br /> * Location: lv2_kernel.self<br /> Added in 3.10. Seems to be Cinavia related?<br /> <br /> == PME Vectors ==<br /> reset external decrem syscall<br /> 482D2D34 482A4F70 482A509C 482A50E4 &lt;- internal<br /> 48202658 482023D0 482024FC 48202544 &lt;- external<br /> 48079C94 4806E624 4806E750 4806E798 &lt;- mambo_internal<br /> <br /> * these denote the location of several things inside lv1. TOC is in the third entry<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> http://img24.imageshack.us/img24/9083/snapshote.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Private Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=44243 Keys 2017-05-24T13:02:45Z <p>93.108.187.41: /* LV1 Magics */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt;<br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt;<br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt;<br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt;<br /> |-<br /> | root || 4.20-4.80 || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.21 || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.21 || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.21 || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.21 || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.21 || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.21 || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: <br /> 1: <br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75)<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75)<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56)<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: <br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Location: lv2_kernel.self<br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys (External)==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> * Location: lv2_kernel.self<br /> <br /> == SCEI_AD_SIGN RSA Keys (Internal) ==<br /> <br /> pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF<br /> exponent : 010001<br /> priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49<br /> p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9<br /> q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67<br /> dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9<br /> dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F<br /> invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE<br /> <br /> * Location: lv2_kernel.self<br /> <br /> == CFK1 Master Keys ==<br /> <br /> INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8<br /> INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d<br /> EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da<br /> EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e<br /> NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185<br /> NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c<br /> <br /> * Location: lv2_kernel.self<br /> Added in 3.10. Seems to be Cinavia related?<br /> <br /> == PME Reset Vectors ==<br /> <br /> 482D2D34482A4F70482A509C482A50E4 &lt;- internal<br /> 48202658482023D0482024FC48202544 &lt;- external<br /> 48079C944806E6244806E7504806E798 &lt;- mambo_internal<br /> <br /> * these denote the location of several things inside lv1. TOC is in the third entry<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> http://img24.imageshack.us/img24/9083/snapshote.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Private Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=44242 Keys 2017-05-24T12:47:00Z <p>93.108.187.41: /* CFK1 Master Keys */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt;<br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt;<br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt;<br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt;<br /> |-<br /> | root || 4.20-4.80 || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.21 || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.21 || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.21 || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.21 || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.21 || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.21 || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: <br /> 1: <br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75)<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75)<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56)<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: <br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Location: lv2_kernel.self<br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys (External)==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> * Location: lv2_kernel.self<br /> <br /> == SCEI_AD_SIGN RSA Keys (Internal) ==<br /> <br /> pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF<br /> exponent : 010001<br /> priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49<br /> p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9<br /> q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67<br /> dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9<br /> dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F<br /> invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE<br /> <br /> * Location: lv2_kernel.self<br /> <br /> == CFK1 Master Keys ==<br /> <br /> INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8<br /> INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d<br /> EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da<br /> EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e<br /> NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185<br /> NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c<br /> <br /> * Location: lv2_kernel.self<br /> Added in 3.10. Seems to be Cinavia related?<br /> <br /> == LV1 Magics ==<br /> <br /> 482D2D34482A4F70482A509C482A50E4 &lt;- internal<br /> 48202658482023D0482024FC48202544 &lt;- external<br /> 48079C944806E6244806E7504806E798 &lt;- mambo_internal<br /> <br /> * these denote the location of several things inside lv1. TOC is in the third entry<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> http://img24.imageshack.us/img24/9083/snapshote.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Private Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=44216 Keys 2017-05-22T18:31:14Z <p>93.108.187.41: /* SCEI_AD_SIGN AES CBC Master Keys */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt;<br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt;<br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt;<br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt;<br /> |-<br /> | root || 4.20-4.80 || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.21 || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.21 || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.21 || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.21 || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.21 || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.21 || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: <br /> 1: <br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75)<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75)<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56)<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: <br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == Lv2_Kernel Unknown Keys ==<br /> <br /> &lt;pre&gt;<br /> keyset1_key1<br /> 1F90E2032162E7E53766C5047B119807<br /> 147AFB579BB705F2AA3DAE35EB22D36B<br /> 9C4B52410EA3EDFB1520D43A757B89F9<br /> C3773873153DBDA5AD8E62E6AD0AE091<br /> keyset1_key2<br /> 4387280F4A69A923ACE904AD5E1A325F<br /> 68F03A8F3883E75E72D018534AB915BF<br /> 85328C09A915BE182CD9AEC5CD60F490<br /> 3D52E0C6D887D46CDEF9FCD0FD3786DC<br /> keyset1_key3<br /> 7649ABAC8119B246CEE98E9B12E9197D<br /> keyset2_key1<br /> 0EDB3843990CC5381332F0E343590CBD<br /> D5978227ACF17D62AED789DE8EB7A192<br /> A3E783098F917F8FD4621F1BB5F74822<br /> 240E6DE31E8ADBAB67FF333AE8E1F91B<br /> keyset2_key2<br /> 36D05CC4574512F974886ACC28B60B69<br /> 2D890DE41353BD9B04E608FD747DF4D1<br /> 9BF75802531FD31EF350287675C94CD2<br /> 2F150F1790E3A58B89B5132074109675<br /> keyset2_key3<br /> 7883552D40B174B01AEA9843EF37B793<br /> &lt;/pre&gt;<br /> <br /> * Added in 3.10. Seems to be Cinavia related?<br /> <br /> == SCEI_AD_SIGN AES CBC Master Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> * Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel<br /> * Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside<br /> * See https://pastebin.com/7gmyRRzy<br /> <br /> == SCEI_AD_SIGN RSA Keys ==<br /> <br /> pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61<br /> exponent : 010001<br /> priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361<br /> p: 00000000D0010F90000000000000000000000000000000000000000000038BE00000000000000000000000000000000000000000000102180000000000002000F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3<br /> q: 000000000000000000000000000000000000000000029F70000000000000000000000000D00109B000000000000360180000000000035F000000000000000000C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB<br /> dp: 000000000002601C000000000000000000000000D001094000000000000360180000000000035F580000000000000000950017000000000000000000000000003CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB<br /> dq: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1<br /> invdp: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> http://img24.imageshack.us/img24/9083/snapshote.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Private Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Keys&diff=44208 Keys 2017-05-22T17:37:57Z <p>93.108.187.41: /* Lv2_Kernel Unknown Keys */</p> <hr /> <div>[http://www.youtube.com/watch?v=wo19Y4tw0l8 Illegal Numbers - Numberphile]<br /> <br /> = Keys Notes =<br /> You can download the keys from: [http://www.ps3devwiki.com/files/devtools/ps3keys/ ps3keys] (or for scetool here : [http://www.ps3devwiki.com/files/devtools/scetool/data/ scetool/data/])<br /> &lt;!--// [https://github.com/search?utf8=%E2%9C%93&amp;q=PS3keys&amp;repo=&amp;langOverride=&amp;start_value=1&amp;type=Repositories&amp;language= ''ps3keys at Github''] / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links [http://www.ps3devwiki.com/files/firmware/MFW-CEX/PS3MFWBuilder/ps3keys.exe ''ps3keys in RAR sfx (254.01 KB)''] / [http://www.mirrorcreator.com/files/EVWOWZES/ps3keys.zip_links ps3keys.zip (229.9 KB)] //--&gt;<br /> <br /> == Location ==<br /> keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys &lt;br /&gt;<br /> <br /> == Naming ==<br /> naming:<br /> * file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np<br /> : (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)<br /> * file suffix: .092 .315 .341 .350 .355 .356<br /> : (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)<br /> * key file (erk): %s-key-%s<br /> * iv file (riv): %s-iv-%s<br /> * ctype file (curvetype): %s-ctype-%s<br /> * pub file (public): %s-pub-%s<br /> * priv file (private): %s-priv-%s<br /> <br /> == Key Table Structure==<br /> === generic in loaders ===<br /> Keys are kept in tables and indexed by the sdk_type in the SELF header.<br /> struct key_obj {<br /> uint8_t key[0x20];<br /> uint8_t iv[0x10];<br /> uint8_t pub[0x28];<br /> uint32_t curve_type;<br /> uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines<br /> }<br /> <br /> === appldr specific ===<br /> typedef struct _appldr_key_container<br /> {<br /> /* start-end (length) */<br /> u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */<br /> u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */<br /> u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */<br /> u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */<br /> u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */<br /> /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */<br /> } appldrKeyContainer;<br /> <br /> appldrKeyContainer rev0x00_0x0c_1[13];<br /> <br /> appldrKeyContainer rev0x00_0x0c_2[13];<br /> <br /> appldrKeyContainer unknown;<br /> <br /> appldrKeyContainer npdrm_1[13];<br /> appldrKeyContainer npdrm_2[13];<br /> <br /> appldrKeyContainer revoke;<br /> <br /> = Curves Notes =<br /> * first &quot;curve&quot; (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)<br /> * second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)<br /> * third curve is the most widely used curve and serves the general use purpose<br /> <br /> = Key Scrambling =<br /> Starting with firmware version 3.60 loader keys have been encrypted. Look [http://www.sendspace.com/file/mx21uz here] for a tool that decrypts them.<br /> Besides that, [http://www.sendspace.com/file/ykermj there is] an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side. <br /> <br /> == Root scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key<br /> |-<br /> | root || 3.60-3.61 || &lt;code&gt;844F80F3C57C455C7F09&lt;/code&gt;<br /> |-<br /> | root || 3.65-3.66 || &lt;code&gt;865128F745845947A0CE&lt;/code&gt;<br /> |-<br /> | root || 3.7x || &lt;code&gt;0DAD161222CDDB00A631&lt;/code&gt;<br /> |-<br /> | root || 4.00-4.1x || &lt;code&gt;D029857926C7A918D48E&lt;/code&gt;<br /> |-<br /> | root || 4.20-4.80 || &lt;code&gt;F5FD0DFD54B738FC8895&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scramble keys ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! type !! version !! key1 !! iv1 !! key2 !! iv2<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;5389A6DFA8567D43A80DA6DAB90EE946&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;212E7E92FF1FB75AE5C1323037C34693&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;E37A763FD7A559CFD7E1E2DA5C8CBAC4&lt;/code&gt; || &lt;code&gt;198361A904E748381CB9AA1DF5CCAB17&lt;/code&gt; || &lt;code&gt;23EAD00FC78D9A8B7785EB600124238C&lt;/code&gt; || &lt;code&gt;61B0D045DF5727EFC19E5BE53BE70F14&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;9FD83EA32E9EAA0EF54AD0CFBB60D1DF&lt;/code&gt; || &lt;code&gt;194B649CDA9F4D814CD119C603E49FB5&lt;/code&gt; || &lt;code&gt;A9709BE3E8043BA24635A2617541E9D5&lt;/code&gt; || &lt;code&gt;F06A5B2FEF9CA87B1759DC53AEE1A3B5&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;FFD6342FC86B81F0E56C6867D618D72A&lt;/code&gt; || &lt;code&gt;A51A2C7960AC1BE43AA0FB7695094188&lt;/code&gt; || &lt;code&gt;194922A1EEB01E614884A44D1D7B7FC1&lt;/code&gt; || &lt;code&gt;90AF09A666BB0C663BF2FC8E5338B7B8&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;4DEA657828657CA86AB93E2162592B97&lt;/code&gt; || &lt;code&gt;EEB72FC7E42544C460E78EA30C72D211&lt;/code&gt; || &lt;code&gt;CE2D1A7AA4F4434058F0C8A64400CBF5&lt;/code&gt; || &lt;code&gt;852CC5C6C5D3B7EEB1801147B32E8D21&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;F92C8666EFFBAC7EB583E54A257F7C05&lt;/code&gt; || &lt;code&gt;F2E70BC4BAC10C3D8DDBB7DC23053F9A&lt;/code&gt; || &lt;code&gt;DDF6A5B143C1141FEED01CDA719705C3&lt;/code&gt; || &lt;code&gt;018E695C3A29AF6E746A73CBF73DBDFD&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65 || &lt;code&gt;546DE455AB15F33546D2296C2535FA44&lt;/code&gt; || &lt;code&gt;ACA9C00DA6D778A95EBD9D76E659C14F&lt;/code&gt; || &lt;code&gt;AB82EF1F62CC382CF2880A870499AE89&lt;/code&gt; || &lt;code&gt;6ECB2AC4DA8D400F0167F1EB9FD8D7F1&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70 || &lt;code&gt;F98E56F3CB0D68797E3D81F0BE36CFBD&lt;/code&gt; || &lt;code&gt;7DA5A5487AFA3032BF49D40CEBEC2480&lt;/code&gt; || &lt;code&gt;7EAFED452D621269CB7EF46D7BE3DAD9&lt;/code&gt; || &lt;code&gt;A5C6E2A25C2DD09D6597F69EEB3A2CE5&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.11 || &lt;code&gt;80863EDBAE50DD4B16125FC9321BBC24&lt;/code&gt; || &lt;code&gt;1A9E31FEBD603A9CBE4ECD6026292466&lt;/code&gt; || &lt;code&gt;D4E2AA7293192CB1600D537A9E832F2D&lt;/code&gt; || &lt;code&gt;4503E4E505A773C55E0B8E1332341287&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;AC19D5DB427351434DC6DA3BD6E3DE6C&lt;/code&gt; || &lt;code&gt;66E68237D5B7228AA2F057B6043768E1&lt;/code&gt; || &lt;code&gt;466CD2F735628B8EF99D1793063BBB3B&lt;/code&gt; || &lt;code&gt;761907BA41A7945028D8FD8305B25BD2&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;A25E7F097B2FC7B1082032C4387DB335&lt;/code&gt; || &lt;code&gt;0655809B26DF5F29E4E740D950A8CB53&lt;/code&gt; || &lt;code&gt;6B97507247CD680FE56D9E19D06DFC71&lt;/code&gt; || &lt;code&gt;B72B9DBB5C2CC74EB75C7B9815DBD5D8&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;4B973A45A23894CBF0CDFC168B7EFB31&lt;/code&gt; || &lt;code&gt;2210B3103E7EDFD8CE0B25551B1D4003&lt;/code&gt; || &lt;code&gt;858CFE093654E3EFA16FCCE5F73C9591&lt;/code&gt; || &lt;code&gt;481472B4DF63EA5F883DAA2872EE5D2F&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;85AEC67CB85BD04D3E7D3D76AA604FF5&lt;/code&gt; || &lt;code&gt;51B40C084A81C9BE35108FFC0C008F64&lt;/code&gt; || &lt;code&gt;616004C6C2D614737106FE41668826A7&lt;/code&gt; || &lt;code&gt;A765A845AAB477EABFEF4274ADA6AF04&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;020397E6D292288F80659F06E2DACEFB&lt;/code&gt; || &lt;code&gt;4CC9A8A9EED889070F066EC9A7CADA2B&lt;/code&gt; || &lt;code&gt;577BA1CBF1FD40A3EF53C9B5DAC3AC60&lt;/code&gt; || &lt;code&gt;B64BF3D04FBB3F8D29F9E63A97DF3DA9&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;872D02292EE7ED3544AFF20EEA5E6F0C&lt;/code&gt; || &lt;code&gt;2E0CBBD250150410302F7E8B33039EF3&lt;/code&gt; || &lt;code&gt;A02BA1F74446E4BAE04AF5CF13D94154&lt;/code&gt; || &lt;code&gt;2009879EED2F443367C80B62F9D1748F&lt;/code&gt;<br /> |-<br /> | appldr || 3.60 || &lt;code&gt;EE409F8CD0B7F8AF17769D5F6D67EA3F&lt;/code&gt; || &lt;code&gt;6BF7B2D5B0ED87EF4CF601D53EEA111A&lt;/code&gt; || &lt;code&gt;2149690206DD0ABC0CD5367C4AF2C810&lt;/code&gt; || &lt;code&gt;39D8E32CF3F1558902247F733D5284BF&lt;/code&gt;<br /> |-<br /> | appldr || 3.65 || &lt;code&gt;D1FF8A1B7AD27A186B0F1E2FFF5C2B65&lt;/code&gt; || &lt;code&gt;4D5EC61604BCE8250E62600376061878&lt;/code&gt; || &lt;code&gt;8F40C9F3CEF5284F5F432BD906ECDF24&lt;/code&gt; || &lt;code&gt;0B107F57C095B31EF15B95FFEC5134B2&lt;/code&gt;<br /> |-<br /> | appldr || 3.70 || &lt;code&gt;2AF91823CE38598E8D66245F698AB572&lt;/code&gt; || &lt;code&gt;D1A74E3DED98145F023F07FFB60D2B1D&lt;/code&gt; || &lt;code&gt;04BE8DD318D3E7454A166296B022F88D&lt;/code&gt; || &lt;code&gt;16D3B1E7B007FDFE101C029B5F39C761&lt;/code&gt;<br /> |-<br /> | appldr || 4.11 || &lt;code&gt;6BFAFA124D4B88841BCB861364C32826&lt;/code&gt; || &lt;code&gt;3F7679B0A1430C490C1F249EAA468D2C&lt;/code&gt; || &lt;code&gt;4338700B5FA64276DD3E57806ED679FD&lt;/code&gt; || &lt;code&gt;CFCAE1AF6F98E5651CBB021D78DD8F1B&lt;/code&gt;<br /> |-<br /> | appldr || 4.21 || &lt;code&gt;AAF65A91EC372C690969090F59E53C3E&lt;/code&gt; || &lt;code&gt;A5798C254313BC5416951E24EAD3C985&lt;/code&gt; || &lt;code&gt;66BCB417D14A2B592640801C11B7B49B&lt;/code&gt; || &lt;code&gt;2FF236152A4776DAD39B509244E8F5C2&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> == Scrambled keysets ==<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! Type !! Version !! ERK || RIV<br /> |-<br /> | rvk_prg || 3.60 || &lt;code&gt;FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4&lt;/code&gt; || &lt;code&gt;E06DC9567BE0EA09D5D1A5355B996FC6&lt;/code&gt;<br /> |-<br /> | rvk_prg || 4.21 || &lt;code&gt;1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8&lt;/code&gt; || &lt;code&gt;30B9F738238A015014A44DD57B3A1661&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60 || &lt;code&gt;7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1&lt;/code&gt; || &lt;code&gt;B3E9683977AE89DE9AFFE6330774505C&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65 || &lt;code&gt;1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0&lt;/code&gt; || &lt;code&gt;2E691E3343A55B99E8A935B0443BD67B&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70 || &lt;code&gt;7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7&lt;/code&gt; || &lt;code&gt;E46F02FDCA9F40CC5CD715D930190FE0&lt;/code&gt;<br /> |-<br /> | isoldr || 4.11 || &lt;code&gt;B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83&lt;/code&gt; || &lt;code&gt;2912F5FC4C4FF400940B369193303D16&lt;/code&gt;<br /> |-<br /> | isoldr || 4.21 || &lt;code&gt;A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D&lt;/code&gt; || &lt;code&gt;36762D06A6F6FBFFE342D8853A3CD440&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60 || &lt;code&gt;18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812&lt;/code&gt; || &lt;code&gt;9B32B20FA77280F1095EA13F1C2D5C99&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.21 || &lt;code&gt;189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3&lt;/code&gt; || &lt;code&gt;E372B32F7E439D30AC6CEC68CA23D903&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60 || &lt;code&gt;451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F&lt;/code&gt; || &lt;code&gt;E8831E56EF9FA4D8D4BF7A6E78025644&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65 || &lt;code&gt;2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739&lt;/code&gt; || &lt;code&gt;FD9D731564C1D1F0A4258667100D1F17&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70 || &lt;code&gt;7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4&lt;/code&gt; || &lt;code&gt;90A06C54C727844AB5300BB6AB54C537&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.11 || &lt;code&gt;ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794&lt;/code&gt; || &lt;code&gt;CF33BDA9F55C71BD9F38B31162FCB0E3&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.21 || &lt;code&gt;B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328&lt;/code&gt; || &lt;code&gt;2D4C6F9F0AAF26A728CA166D03449321&lt;/code&gt;<br /> |-<br /> | edat-key-0 || 4.21 || &lt;code&gt;270C4A349DE7A329BB04FD8642C43591&lt;/code&gt; || <br /> |-<br /> | edat-hash-0 || 4.21 || &lt;code&gt;25790BA9D671FB125E53F013B0F9862E&lt;/code&gt; || <br /> |-<br /> | edat-key-1 || 4.21 || &lt;code&gt;D1DF87B5C1471B360ACE21315A339C06&lt;/code&gt; || <br /> |-<br /> | edat-hash-1 || 4.21 || &lt;code&gt;6D4BF3D7245DB294B6C3F9E32AA57E79&lt;/code&gt; || <br /> |-<br /> |}<br /> <br /> = Key lists =<br /> <br /> == sc_iso module 060.013.r010 - 4.75 ==<br /> 0: <br /> 1: <br /> 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75)<br /> 2: 73636B65795F7365726965736B657900 (INTERNAL)<br /> 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75)<br /> 3: 73636B65795F7365726965736B657932 (INTERNAL)<br /> 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56)<br /> 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75)<br /> 4: 73636B65795F666F725F6D6173746572 (INTERNAL)<br /> 5: <br /> see also: http://pastie.org/3130817 / http://pastie.org/10206783<br /> <br /> == sb_iso_spu_module 083.006.r010 / 1.02 ==<br /> 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 &lt;- sb_iso_magic_px<br /> 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E &lt;- sb_iso_fix2_px<br /> 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 &lt;- sb_iso_fix1_px<br /> 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 &lt;- sb_iso_magic_dx<br /> 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF &lt;- sb_iso_fix2_dx<br /> 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 &lt;- sb_iso_fix1_dx<br /> <br /> == sb_iso_spu_module 3.41 ==<br /> 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4<br /> 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4<br /> 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E<br /> 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27<br /> A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121<br /> B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609<br /> note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)<br /> <br /> <br /> == sv_iso_spu_module 095.001 - 3.55 ==<br /> key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv<br /> <br /> iv_0(giv): 2226928D44032F436AFD267E748B2393<br /> key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0<br /> key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1<br /> <br /> key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0<br /> <br /> iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1<br /> <br /> key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)<br /> iv_2(IVh): 69474772AF6FDAB342743AEFAA186287<br /> <br /> debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)<br /> <br /> ivs_3des: E80B3F0CD6566DD0<br /> <br /> eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9<br /> eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3<br /> <br /> eid4_fallback keys added from this [http://www.ps3-hacks.org/ps3-scetool-friday-isolated-spu-poc-and-eidtool-wip-updates.html source]<br /> <br /> trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj<br /> <br /> == spu_token_processor ==<br /> 095.001 - 3.56:<br /> token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A<br /> token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED<br /> token-iv: E8663A69CD1A5C454A761E728C7C254E<br /> 3.60-{{latest}}:<br /> token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404<br /> token-curve-type: 0x9<br /> <br /> 08x - ???{{SD}}<br /> token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B<br /> token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA<br /> token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3<br /> <br /> == spu_utoken_processor 3.55 ==<br /> utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA<br /> utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736<br /> utoken-iv: A6523E5426470953FE8C90F61BCA927A<br /> <br /> == sc_iso ==<br /> secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - {{latest}}<br /> secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70<br /> sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7<br /> sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE<br /> sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2<br /> sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22<br /> sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654<br /> sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B<br /> sc_key::key_for_master : 73636B65795F666F725F6D6173746572<br /> sc_key::series_key : 73636B65795F7365726965736B657900<br /> sc_key::series_key2 : 73636B65795F7365726965736B657932<br /> <br /> == gpkg-key ==<br /> ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8<br /> &lt;!--//u8 retail_pkg_aes_key[] = {0x2E,0x7B,0x71,0xD7,0xC9,0xC9,0xA1,0x4E,0xA3,0x22,0x1F,0x18,0x88,0x28,0xB8,0xF8};//--&gt;<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.<br /> psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B<br /> * Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.<br /> <br /> == service mode dongle HMAC ==<br /> 46DCEAD317FE45D80923EB97E4956410D4CDB2C2<br /> <br /> == PUP HMAC ==<br /> F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366<br /> <br /> == DAT ==<br /> dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF<br /> dat-key: 2B7E151628AED2A6ABF7158809CF4F3C<br /> <br /> == EDAT ==<br /> edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE<br /> edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081<br /> edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011<br /> edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747<br /> <br /> == SDAT ==<br /> sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)<br /> <br /> == PS3 Minis ==<br /> ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)<br /> ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)<br /> <br /> Note: for minis iso.bin.edat<br /> <br /> == aim keys ==<br /> aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 &lt;- idps_magic10<br /> aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF &lt;- idps_magic<br /> aim_iv : 51F78B72A64711CF5C72323FB8607A00 &lt;- magic_iv0<br /> aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 &lt;- magic_key0<br /> aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)<br /> http://pastie.org/2547291<br /> (ks version depends on the first four bytes of the eid) &lt;br /&gt;<br /> aim_compare-&gt;magic_0(note that there's magic_1 and magic_2 also on really old firmwares)<br /> <br /> == mode_auth_data == <br /> key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF<br /> iv : 0123456789ABCDEFFEDCBA9876543210<br /> hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037<br /> F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872<br /> magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)<br /> http://pastie.org/4155189<br /> <br /> (Product Mode authentication data)<br /> <br /> == SYSCON_MANAGER_KEY ==<br /> <br /> D413B89663E1FE9F75143D3BB4565274<br /> <br /> [[Keys#sc_iso_module_1.00-4.00|sc_iso_module_1.00-4.00]]&lt;br /&gt;<br /> [http://www.ps3hax.net/showthread.php?t=68857&amp;p=721426 source]<br /> <br /> == AACS key/iv ==<br /> <br /> aes-256-ctr_key:<br /> 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96<br /> aes-256-ctr iv:<br /> 802794556C7716719B40A175DB9A455E<br /> [[http://pastebin.com/kasHaXKp Another decrypted arrays with this key]]<br /> <br /> <br /> magic: FolkloreJam<br /> <br /> key:<br /> 2DC2DF39420321D0CEF1FE2374029D95<br /> iv:<br /> 0BA0F8DDFEA61FB3D8DF9F566A050F78<br /> <br /> new magic: CODEFACE<br /> <br /> public key 1 enc:<br /> 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2<br /> public key 1 dec:<br /> 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27<br /> public key 2 enc:<br /> 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122<br /> public key 2 dec:<br /> 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7<br /> public key 3 enc:<br /> 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5<br /> public key 3 dec:<br /> 00000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> <br /> Curve:<br /> &lt;pre&gt;<br /> p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF<br /> a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC<br /> b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8<br /> N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017<br /> Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6<br /> Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9<br /> &lt;/pre&gt;<br /> <br /> Second aes-256-ctr_key:<br /> 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384<br /> Second aes-256-ctr iv:<br /> BC0D7738D332B780A6F89ED022745F0A<br /> <br /> == CPRM ==<br /> Decryption key for obfuscated arrays:<br /> <br /> Key 688D8FECC3AAB50AAE45506B41A48BC3<br /> IV 6AC5B2F7055C031AE36BA31D285D24E5<br /> <br /> Decrypted array 1:<br /> 3AD09AB6F5C116B758F6EDE6D98C57FC<br /> FD4B9B470E8EFFF3BBBA0A8015D72B36<br /> 6A435A89B45D71198FA088B8E88AC3AE<br /> 7C4E3DB596CC21001A6B12DB1FE4119D<br /> D39368B07F3B52B994DDA51B466031EC<br /> C9F8E95E1398BF27560891E36F2040B2<br /> 2CCE0210E018D56CDECD8779AFA92650<br /> F233926EC03F3941AA5B7D2403D62FEB<br /> 0B99864C51458D2EEF077BE24D7AFE25<br /> 5C29A2A8B1F0B3C4307E6338CBF44FD1<br /> DF4432DC175F662A819E774A656734FA<br /> 541E14BE04F1A79C8B37EE85AB220F69<br /> C5D40584A47342A164E1708390C2480D<br /> 611CC672FB7674E701D8C8D275A3CF28<br /> 821D4935C7BDCAA6AC0C62ADF93CEA2D<br /> 59DA3E976D09F755E523539F06BC9578<br /> <br /> Decrypted array 2:<br /> 009153EE3EC7524B0000000000000000<br /> <br /> == AV CC Multi ==<br /> <br /> 942C152C1C2C9D2C94AE15AE1CAE9DAE<br /> <br /> == Archive keys ==<br /> <br /> FA72CEEF59B4D2989F111913287F51C7 generic key<br /> <br /> EA02CEEF5BB4D2998F611910D77F51C6 per console key<br /> <br /> == Marlin DRM ==<br /> <br /> DES key/iv? 7563686979616D61 <br /> <br /> KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443<br /> <br /> == DivX DRM ==<br /> <br /> Key 0678CE0EC45DA9554D2CDA549B91BC1C<br /> <br /> == Arcade Master Key ==<br /> <br /> Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F<br /> IV 929214D8FCCB4CE7099ACEBDFC6612B9<br /> <br /> * used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds<br /> * located at Lv1Ldr<br /> <br /> == Arcade ATA Decryption Key ==<br /> <br /> Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A<br /> IV 00000000000000000000000000000000<br /> <br /> * algo is aes-192-cbc, used for System 357A (GECR-1100)<br /> * Key forged by encrypting Arcade ATA Seeds with Master Key<br /> <br /> == Lv2_Kernel Unknown Keys ==<br /> <br /> &lt;pre&gt;<br /> keyset1_key1<br /> 1F90E2032162E7E53766C5047B119807<br /> 147AFB579BB705F2AA3DAE35EB22D36B<br /> 9C4B52410EA3EDFB1520D43A757B89F9<br /> C3773873153DBDA5AD8E62E6AD0AE091<br /> keyset1_key2<br /> 4387280F4A69A923ACE904AD5E1A325F<br /> 68F03A8F3883E75E72D018534AB915BF<br /> 85328C09A915BE182CD9AEC5CD60F490<br /> 3D52E0C6D887D46CDEF9FCD0FD3786DC<br /> keyset1_key3<br /> 7649ABAC8119B246CEE98E9B12E9197D<br /> keyset2_key1<br /> 0EDB3843990CC5381332F0E343590CBD<br /> D5978227ACF17D62AED789DE8EB7A192<br /> A3E783098F917F8FD4621F1BB5F74822<br /> 240E6DE31E8ADBAB67FF333AE8E1F91B<br /> keyset2_key2<br /> 36D05CC4574512F974886ACC28B60B69<br /> 2D890DE41353BD9B04E608FD747DF4D1<br /> 9BF75802531FD31EF350287675C94CD2<br /> 2F150F1790E3A58B89B5132074109675<br /> keyset2_key3<br /> 7883552D40B174B01AEA9843EF37B793<br /> &lt;/pre&gt;<br /> <br /> * Added in 3.10. Seems to be Cinavia related?<br /> <br /> == SCEI_AD_SIGN AES CFB Keys ==<br /> RIV0: 8ceb482d10befb61871b6407dcfce7a3<br /> KEY0: 3683a2fae5e62fc59004db1911c0562f<br /> RIV1: 08080b7163e4fbabc2905023d430fc92<br /> KEY1: c4b92b1e1fc6429ae63701340336a529<br /> <br /> == Modules ==<br /> <br /> ==== Notes ====<br /> * in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)<br /> * With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms <br /> * Likewise, the individual_info erk is 256 bit size, but only first half is used.<br /> <br /> <br /> ''A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf<br /> <br /> * &amp;lt;= 3.55:<br /> ** Randomfail present, thus when private key is unknown: use scekrit ;<br /> ** No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)<br /> * 3.56:<br /> ** Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [http://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/?ALLSTEPS] ;<br /> ** No obfuscation added to loaders ''yet''<br /> * =&amp;gt;3.60:<br /> ** fixed the randomfail since 3.56, thus scekrit is of no use ;<br /> ** Obfuscation of keytable was added since 3.60 see [[Keys#Key_Scrambling|Key Scrambling]], which used [[Undocumented SPU Channels|ch72]] ringbuffer seed for deobfuscation.<br /> *** &quot;dec&quot; in ldr table refers to the deobfuscated key as used by crypto engine ;<br /> *** &quot;enc&quot; in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable<br /> <br /> ===Lv0Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-key for decrypting<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv0ldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 0.60+ || &lt;code&gt;CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A&lt;/code&gt; || &lt;code&gt;F9205F46F6021697E670F13DFA726212&lt;/code&gt; || &lt;code&gt;A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D&lt;/code&gt; || &lt;code&gt;001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |-&lt;!--// key for decrypting lv0, inside lv0ldr //--&gt;<br /> | lv0ldr || 030.001-050.013 ({{CEB}}) || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===MetLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | metldr&lt;br /&gt;(Internal) || - ({{SD}}) || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | metldr || - || &lt;code&gt;C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B&lt;/code&gt; || &lt;code&gt;47EE7454E4774CC9B8960C7B59F4C14D&lt;/code&gt; || &lt;code&gt;C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019&lt;/code&gt; || &lt;code&gt;00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Lv1ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80 || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | lv1ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv1ldr || 030.001-3.31 || &lt;code&gt;B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222&lt;/code&gt; || &lt;code&gt;B43661B9A79BAD9D8E2B046469CDA1E7&lt;/code&gt; || &lt;code&gt;4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20&lt;/code&gt; || &lt;code&gt;002CC736C7AD06D264E9AB663EB1F35F5DC159248C&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.40-3.42 || &lt;code&gt;B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646&lt;/code&gt; || &lt;code&gt;A79B05D4E37B8117A95E6E7C14FB640E&lt;/code&gt; || &lt;code&gt;7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375&lt;/code&gt; || &lt;code&gt;00033A699FDD2DA6CDD6CCC03B2C6145F998706F74&lt;/code&gt; || &lt;code&gt;0x34&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.50 || &lt;code&gt;1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7&lt;/code&gt; || &lt;code&gt;E034D31A80316960024D1B3D3164FDC3&lt;/code&gt; || &lt;code&gt;7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398&lt;/code&gt; || &lt;code&gt;005815D17125D04C33790321DE29EB6241365100B5&lt;/code&gt; || &lt;code&gt;0x35&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.55 || &lt;code&gt;53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23&lt;/code&gt; || &lt;code&gt;44E652661AC7584DBE08ECB810FB5FC0&lt;/code&gt; || &lt;code&gt;733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9&lt;/code&gt; || &lt;code&gt;004312C65347ACBE95CC306442FEFD0AF4C2935EB3&lt;/code&gt; || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.56 || &lt;code&gt;48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83&lt;/code&gt; || &lt;code&gt;15DCF3C67147A45D09DE7521EECA07A1&lt;/code&gt; || &lt;code&gt;85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.60-3.61 || &lt;code&gt;5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5&lt;/code&gt; || &lt;code&gt;DF0F50EC3C4743C5B17839D7B49F24A4&lt;/code&gt; || &lt;code&gt;1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E&lt;/code&gt; || - || &lt;code&gt;0x05&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.65-3.66 || &lt;code&gt;BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951&lt;/code&gt; || &lt;code&gt;569AF3745E1E02E3E288273CDE244CD8&lt;/code&gt; || &lt;code&gt;21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv1ldr || 3.70-3.74 || &lt;code&gt;41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE&lt;/code&gt; || &lt;code&gt;C8C98D5A5CE23AF5607A352AECACB0DC&lt;/code&gt; || &lt;code&gt;4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.00-4.11 || &lt;code&gt;557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74&lt;/code&gt; || &lt;code&gt;7144D7574937818517826227EF4AC0B4&lt;/code&gt; || &lt;code&gt;085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | lv1ldr || 4.20-{{latest}} || &lt;code&gt;10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD&lt;/code&gt; || &lt;code&gt;ED8699562C6AC65204FA166257E7FCF4&lt;/code&gt; || &lt;code&gt;9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |}<br /> <br /> ===Lv2Ldr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | lv2ldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573&lt;/code&gt; || &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 030.001-3.31 || &lt;code&gt;94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F&lt;/code&gt; || &lt;code&gt;9769BFD187B90990AE5FEA4E110B9CF5&lt;/code&gt; || &lt;code&gt;AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D&lt;/code&gt; || &lt;code&gt;0070ABF9361B02291829D479F56AB248203CD3EB46&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.40-3.42 || &lt;code&gt;575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10&lt;/code&gt; || &lt;code&gt;411CB18F460CE50CAF2C426D8F0D93C8&lt;/code&gt; || &lt;code&gt;3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA&lt;/code&gt; || &lt;code&gt;0073076441A08CD179E5FACE349B86DA58B5B7BA78&lt;/code&gt; || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.50 || &lt;code&gt;6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68&lt;/code&gt; || &lt;code&gt;603A36213708520ED5D745DEC1325BA5&lt;/code&gt; || &lt;code&gt;5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3&lt;/code&gt; || &lt;code&gt;0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.55 || &lt;code&gt;84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17&lt;/code&gt; || &lt;code&gt;5B240444D645F2038118F97FD5A145D5&lt;/code&gt; || &lt;code&gt;B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72&lt;/code&gt; || &lt;code&gt;009D4CBA2BFB1A8330D3E20E59D281D476D231C73A&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.56 || &lt;code&gt;EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359&lt;/code&gt; || &lt;code&gt;9CA9282DC7FA9F315EF3156D970B7CD4&lt;/code&gt; || &lt;code&gt;0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.60-3.61 || &lt;code&gt;88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC&lt;/code&gt; || &lt;code&gt;8D18E8E525230E63DE10291C9DD615BF&lt;/code&gt; || &lt;code&gt;86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.65-3.66 || &lt;code&gt;688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0&lt;/code&gt; || &lt;code&gt;75E0239D18B0B669EAE650972F99726B&lt;/code&gt; || &lt;code&gt;008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | lv2ldr || 3.70-3.74 || &lt;code&gt;E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254&lt;/code&gt; || &lt;code&gt;15058FA7F2CAD7C528B5F605F6444EB0&lt;/code&gt; || &lt;code&gt;438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.00-4.11 || &lt;code&gt;A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97&lt;/code&gt; || &lt;code&gt;BBE7799B9A37CB272E386618FDFD4AEC&lt;/code&gt; || &lt;code&gt;5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> | lv2ldr || 4.20-{{latest}} || &lt;code&gt;0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03&lt;/code&gt; || &lt;code&gt;9B79374722AD888EB6A35A2DF25A8B3E&lt;/code&gt; || &lt;code&gt;1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50&lt;/code&gt; || - || &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===IsoLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! Revision !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | isoldr&lt;br /&gt;(Internal) || {{SD}} 0.80-3.31 || 0x01 ||&lt;code&gt;9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9&lt;/code&gt; || &lt;code&gt;2C1F4C82FF3A796D3A772CEEF010ECA4&lt;/code&gt; || &lt;code&gt;625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782&lt;/code&gt; || &lt;code&gt;00D19A1B338041F7C31062B9C40E725E1DA5D7C11A&lt;/code&gt; || &lt;code&gt;0x20&lt;/code&gt;<br /> |-<br /> | isoldr || 0.80-3.31 || 0x01 || &lt;code&gt;8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4&lt;/code&gt; || &lt;code&gt;C82D015D46CF152F1DD0C16F18B5B1E5&lt;/code&gt; || &lt;code&gt;733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29&lt;/code&gt; || &lt;code&gt;009BE892E122A5C943C1BB7403A67318AA9E1B286F&lt;/code&gt; || &lt;code&gt;0x36&lt;/code&gt;<br /> |-<br /> | isoldr || 3.40-3.42 || 0x01 || &lt;code&gt;101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D&lt;/code&gt; || &lt;code&gt;8D2E9C6297B8AD252998458296AC773C&lt;/code&gt; || &lt;code&gt;138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625&lt;/code&gt; || &lt;code&gt;00849DBC57D3B92F01864E6E82EB4EF0EF6311E122&lt;/code&gt; || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | isoldr || 3.50 || 0x01 || &lt;code&gt;3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843&lt;/code&gt; || &lt;code&gt;A414AC1DB7987E43777651B330B899E1&lt;/code&gt; || &lt;code&gt;1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F&lt;/code&gt; || &lt;code&gt;0085B4B05DEBA7E6AD831653C974D95149803BB272&lt;/code&gt; || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | isoldr || 3.55 || 0x01 || &lt;code&gt;BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37&lt;/code&gt; || &lt;code&gt;0207A479B1574F8E7F697528F05D5435&lt;/code&gt; || &lt;code&gt;917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58&lt;/code&gt; || &lt;code&gt;00294411363290975BA551336D3965D88AF029A17B&lt;/code&gt; || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.56 || 0x01 || &lt;code&gt;311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE&lt;/code&gt; || &lt;code&gt;7BB8B3F5AC8E0890E3148AE5688C7350&lt;/code&gt; || &lt;code&gt;3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.60-3.61 || 0x01 || &lt;code&gt;8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093&lt;/code&gt; || &lt;code&gt;FFF9CACCC4129125CAFB240F419E5F39&lt;/code&gt; || &lt;code&gt;098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556&lt;/code&gt; || - || &lt;code&gt;0x03&lt;/code&gt;<br /> |-<br /> | isoldr || 3.65-3.66 || 0x01 || &lt;code&gt;E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592&lt;/code&gt; || &lt;code&gt;D292A7BD57C0BB2EABBCA1252FA9EDEF&lt;/code&gt; || &lt;code&gt;2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5&lt;/code&gt; || - || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x01 || &lt;code&gt;072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51&lt;/code&gt; || &lt;code&gt;8516A81F02CF938740498A406C880871&lt;/code&gt; || &lt;code&gt;5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D&lt;/code&gt; || - || &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | isoldr || 3.70-3.74 || 0x0100 || &lt;code&gt;786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8&lt;/code&gt; || &lt;code&gt;94662F13D99A9F5D211C979FFDF65FE3&lt;/code&gt; || &lt;code&gt;912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B&lt;/code&gt; || - || &lt;code&gt;0x0E&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x01 || &lt;code&gt;4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD&lt;/code&gt; || &lt;code&gt;4F1E3EF07D893A4714B1B3D5A4E50479&lt;/code&gt; || &lt;code&gt;4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702&lt;/code&gt; || - || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | isoldr || 4.00-4.11 || 0x0100 || &lt;code&gt;16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B&lt;/code&gt; || &lt;code&gt;0E50DB6D937D262CB0499136852FCB80&lt;/code&gt; || &lt;code&gt;AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC&lt;/code&gt; || - || &lt;code&gt;0x0F&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x01 || &lt;code&gt;63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086&lt;/code&gt; || &lt;code&gt;953F6A99891B4739358F5363A00C08B9&lt;/code&gt; || &lt;code&gt;26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612&lt;/code&gt; || - || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | isoldr || 4.20-{{latest}} || 0x0100 || &lt;code&gt;B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C&lt;/code&gt; || &lt;code&gt;B96EA32CB96EA32DB96EA32DB96EA32C&lt;/code&gt; || &lt;code&gt;2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spp verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spp_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spp_verifier || 0.80-3.55 || &lt;code&gt;56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A&lt;/code&gt; || &lt;code&gt;007E6B268EF1E986D10A9889CF93A8CB&lt;/code&gt; || &lt;code&gt;265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A&lt;/code&gt; || &lt;code&gt;0001608EF3BACAFFB8C3A5958A24F758325B62B08C&lt;/code&gt; || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.56 || &lt;code&gt;7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0&lt;/code&gt; || &lt;code&gt;B889290922B002F57086B818A8FDE3CC&lt;/code&gt; || &lt;code&gt;71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.60-3.61 || &lt;code&gt;ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2&lt;/code&gt; || &lt;code&gt;3E05572881C5BC845D310EAC28497B08&lt;/code&gt; || &lt;code&gt;504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E&lt;/code&gt; || - || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.65-3.66 || &lt;code&gt;E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4&lt;/code&gt; || &lt;code&gt;0F23BBED0473B4899AD793AC76D8F722&lt;/code&gt; || &lt;code&gt;934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F&lt;/code&gt; || - || &lt;code&gt;0x22&lt;/code&gt;<br /> |-<br /> | spp_verifier || 3.70-3.74 || &lt;code&gt;4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0&lt;/code&gt; || &lt;code&gt;3B6203C2730D283F978A12D5390DD747&lt;/code&gt; || &lt;code&gt;0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8&lt;/code&gt; || - || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.00-4.11 || &lt;code&gt;11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF&lt;/code&gt; || &lt;code&gt;67B49380C74FFB15AD929E8C819586AD&lt;/code&gt; || &lt;code&gt;5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3&lt;/code&gt; || - || &lt;code&gt;0x04&lt;/code&gt;<br /> |-<br /> | spp_verifier || 4.20-{{latest}} || &lt;code&gt;D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5&lt;/code&gt; || &lt;code&gt;6D308B59BC9054B12C833359D31BAE77&lt;/code&gt; || &lt;code&gt;0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5&lt;/code&gt; || - || &lt;code&gt;0x07&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===RvkLdr===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | rvklist&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | rvklist || 030.001-3.55 || &lt;code&gt;03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;8B5D7876F40A9E1E9AC2B22F51B60BDF&lt;/code&gt; || &lt;code&gt;9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7&lt;/code&gt; || &lt;code&gt;00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | rvklist || 3.56 || &lt;code&gt;22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE&lt;/code&gt; || &lt;code&gt;D5D4B8ED62B6CCA0249A79776E136975&lt;/code&gt; || &lt;code&gt;51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B&lt;/code&gt; || - || &lt;code&gt;0x32&lt;/code&gt;<br /> |-<br /> | rvklist || 3.60-3.61 || &lt;code&gt;BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3&lt;/code&gt; || &lt;code&gt;B20A23079516205525683D8058379CBF&lt;/code&gt; || &lt;code&gt;9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6&lt;/code&gt; || - || &lt;code&gt;0x33&lt;/code&gt;<br /> |-<br /> | rvklist || 3.65-3.66 || &lt;code&gt;1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C&lt;/code&gt; || &lt;code&gt;501819323BFCF9FB99396B46B70A97E7&lt;/code&gt; || &lt;code&gt;6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448&lt;/code&gt; || - || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | rvklist || 3.70-3.74 || &lt;code&gt;4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4&lt;/code&gt; || &lt;code&gt;0E5CB28FA2666E3ED45289DABC67DDC2&lt;/code&gt; || &lt;code&gt;758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371&lt;/code&gt; || - || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | rvklist || 4.00-4.11 || &lt;code&gt;99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E&lt;/code&gt; || &lt;code&gt;182CC801794A2F7027BB76D29D598550&lt;/code&gt; || &lt;code&gt;6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C&lt;/code&gt; || - || &lt;code&gt;0x02&lt;/code&gt;<br /> |-<br /> | rvklist || 4.20-{{latest}} || &lt;code&gt;695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17&lt;/code&gt; || &lt;code&gt;a8ba3e4e63b2bb06fc0ce57e3bb8fc46&lt;/code&gt; || &lt;code&gt;7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Spu Pkg Rvk Verifier===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | spu_pkg_rvk_verifier&lt;br /&gt;(Internal) || - {{SD}} || &lt;code&gt;FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF&lt;/code&gt; || &lt;code&gt;0123456789ABCDEFFEDCBA9876543210&lt;/code&gt; || &lt;code&gt;123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872&lt;/code&gt; || &lt;code&gt;000000000000000000000000000000000001000000&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 0.80-3.55 (pkg) || &lt;code&gt;A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031&lt;/code&gt; || &lt;code&gt;4ACEF01224FBEEDF8245F8FF10211E6E&lt;/code&gt; || &lt;code&gt;41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 &lt;/code&gt; || &lt;code&gt;00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 &lt;/code&gt; || &lt;code&gt;0x23&lt;/code&gt;<br /> |-<br /> | spu_pkg_rvk_verifier || 3.56-{{latest}} (spkg) || &lt;code&gt;F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD&lt;/code&gt; || &lt;code&gt;59D28DB4ADDFB40B7D768BC9667C67B1&lt;/code&gt; || &lt;code&gt;5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0&lt;/code&gt; || - || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===Updater (CEB units Ebootroms)=== <br /> Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Version !! ERK !! RIV<br /> |-<br /> | updater || E/rXXX || &lt;code&gt;D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920&lt;/code&gt; || &lt;code&gt;CB445249CE6A9FEB01DF02C7B94938E1&lt;/code&gt;<br /> |-<br /> | individual_info || E/rXXX || &lt;code&gt;987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243&lt;/code&gt; || &lt;code&gt;1AAEBF3ED6EB1B295DAC75963DB37651&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> ===toolupdatedec (Communication Processor Updater binary)===<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Module !! Target !! Filename !! ERK !! RIV<br /> |-<br /> | toolupdatedec || TCP510/TCP520 || reftool_cp_xxx.bin || &lt;code&gt;E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> | toolupdatedec || DTP-T1000 || psptoolupdate.bin || &lt;code&gt;A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB&lt;/code&gt; || &lt;code&gt;File dependant (the first 16 bytes of the file)&lt;/code&gt;<br /> |-<br /> |}<br /> <br /> === PS3 Suffix for NIDS ===<br /> &lt;pre&gt;<br /> 6759659904250490566427499489741A<br /> &lt;/pre&gt;<br /> <br /> === Bluray Drive Keys (retrieved from bluray drive firmware) ===<br /> <br /> 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F<br /> 97EC3F4F8751F22B7FFCACA83803EAF7<br /> <br /> or<br /> <br /> E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7<br /> 5BCE24712335AF70E570F6559A29F34D<br /> <br /> * Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.&lt;br /&gt;<br /> * Signature is at the bottom of the firmware. (0x7fd0) &lt;br /&gt;<br /> * it's highly likely to be cbc 256 aes<br /> <br /> XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE<br /> <br /> It can be used to decrypt emboot and another perdevice areas.<br /> <br /> === EID0 Section Keys ===<br /> <br /> Public key00: &lt;code&gt;94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A&lt;/code&gt;&lt;br /&gt;<br /> Curve00 sha1: &lt;code&gt;9035B33F58DFAEF389FD49187F93C4FC2D2DD268&lt;/code&gt; <br /> &lt;br&gt;Curve:<br /> &lt;pre&gt;<br /> A34D0C98B2A8DEA81E7C3FF0757C5B89<br /> 1B8523E1A34D0C98B2A8DEA81E7C3FF0<br /> 757C5B891B8523DE929F2B86E0F6525F<br /> FDC819D76D5F139A2F8A49B300A34D0C<br /> 98B2A8DEA81E7CEC7E21A8FF20DC9B8F<br /> AF755FD420216829E389548D397246E6<br /> 6DF2EC4B7C9B308B62B9CEFFA3F0071A<br /> 5C396F67FCE4A3A683<br /> &lt;/pre&gt;<br /> [https://twitter.com/naehrwert/status/286745714434899968 twitter]&lt;br /&gt;<br /> <br /> Public key06: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt;&lt;br /&gt;<br /> Curve type06: 2 (vsh)&lt;br /&gt;<br /> <br /> Public key0A: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt;&lt;br /&gt;<br /> Curve type0A: 2 (vsh)&lt;br /&gt;<br /> <br /> === PSP ID-Storage Keys ===<br /> '''IDPS'''&lt;br /&gt;<br /> Public key00: &lt;code&gt;4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E&lt;/code&gt;&lt;br /&gt;<br /> Curve type00: 2 (vsh)&lt;br /&gt;<br /> Public key01: &lt;code&gt;06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE&lt;/code&gt; &lt;-Same as EID0 Public key06&lt;br /&gt;<br /> Curve type01: 2 (vsh)&lt;br /&gt;<br /> Public key02: &lt;code&gt;3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5&lt;/code&gt;&lt;br /&gt;<br /> Curve type02: 2 (vsh)&lt;br /&gt;<br /> Public key03: &lt;code&gt;CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786&lt;/code&gt;&lt;br /&gt;<br /> Curve type03: 2 (vsh)&lt;br /&gt;<br /> Public key04: &lt;code&gt;08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6&lt;/code&gt;&lt;br /&gt;<br /> Curve type04: 2 (vsh)&lt;br /&gt;&lt;br /&gt;<br /> '''UMD'''&lt;br /&gt;<br /> Public key: &lt;code&gt;4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A&lt;/code&gt; &lt;-Same as EID0 Public key0A&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> === Appldr ===<br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! selftype !! version !! revision !! fw !! type !! ERK !! RIV !! PUBLIC !! PRIVATE !! CURVE_TYPE<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app Internal {{SD}} || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;A17D6A522CB1B08F97DA8A82E97C12F7&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80-0.92 || 0x00 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.80++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;4A0955D946DB70D691A640BB7FAECC4C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 &lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x21&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92[[Talk:Keys#2.36_vs_3.30_appldr_key_79481839C4...|-2.36]]&lt;strike&gt;/3.31&lt;/strike&gt; || 0x01 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 0.92++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;6F0F25E1C8C4B7AE70DF968B04521DDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;003DE80167D2F0E9D30F2145144A558D1174F5410C&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;?-2.36&lt;/span&gt; || 0x02 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;1.00++&lt;/span&gt; || dec || &lt;code&gt;4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A&lt;/code&gt; || &lt;code&gt;90C127A9B43BA9D8E89FE6529E25206F&lt;/code&gt; || &lt;code&gt;8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E&lt;/code&gt; || &lt;code&gt;00530446451C568968EBF7068B1F45C252D70EC942&lt;/code&gt; || &lt;code&gt;0x13&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;?-2.36&lt;/span&gt; || 0x00 ? || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;0.85&amp;nbsp;&amp;lt;=3.30&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;code&gt;DC01280A6E46BC674B81A7E8801EBE6E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt; &lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x11&lt;/code&gt;&lt;!--// is not in 3.56 FIX //--&gt;<br /> |-<br /> | npdrm || ?-2.36 || 0x00 np || 1.00++ || dec || &lt;code&gt;8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86&lt;/code&gt; || &lt;code&gt;7AAECC60AD12AED90C348D8C11D2BED5&lt;/code&gt; || &lt;code&gt;05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0A&lt;/code&gt;<br /> |-<br /> | npdrm || 0.92-2.36 || 0x01 np || 1.00++ || dec || &lt;code&gt;F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B&lt;/code&gt; || &lt;code&gt;A551CCB4A42C37A734A2B4F9657D5540&lt;/code&gt; || &lt;code&gt;B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF&lt;/code&gt; || &lt;code&gt;00040AB47509BED04BD96521AD1B365B86BF620A98&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40-3.30&lt;/span&gt; || 0x03 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;2.40++&lt;/span&gt; || dec || &lt;code&gt;C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E&lt;/code&gt; || &lt;code&gt;E0908163F457576440466ACAA443AE7C&lt;/code&gt; || &lt;code&gt;50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x0B&lt;/code&gt;<br /> |-<br /> | npdrm || 2.40-3.30 || 0x03 np || 2.40++ || dec || &lt;code&gt;1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664&lt;/code&gt; || &lt;code&gt;E31E206FBB8AEA27FAB0D9A2FFB6B62F&lt;/code&gt; || &lt;code&gt;3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40-3.42 || 0x04 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.40++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;7FDBB2E924D182BB0D69844ADC4ECA5B&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0074E922FDEE5DC4CDF22FC8D7986477F813400860&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x14&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC&lt;/code&gt; || &lt;code&gt;15D3F191295C94B09B71EBDE088A187A&lt;/code&gt; || &lt;code&gt;B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x06 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.40++&lt;/span&gt; || dec || &lt;code&gt;6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41&lt;/code&gt; || &lt;code&gt;24BD1C19D2A8286B8ACE39E4A37801C2&lt;/code&gt; || &lt;code&gt;71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2C&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.40-3.42&lt;/span&gt; || 0x05 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.40&amp;nbsp;&amp;lt;=3.42&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;86F56F9E5DE513894874B8BA253334B1&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x12&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x04 np || 3.40++ || dec || &lt;code&gt;BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706&lt;/code&gt; || &lt;code&gt;ADF7B207A15AC601110E61DDFC210AF6&lt;/code&gt; || &lt;code&gt;9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30&lt;/code&gt; || &lt;code&gt;00B61A91DF4AB6A9F142C326BA9592B5265DA88856&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | npdrm || 3.40-3.42 || 0x06 np || 3.40++ || dec || &lt;code&gt;8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020&lt;/code&gt; || &lt;code&gt;05719DF1B1D0306C03910ADDCE4AF887&lt;/code&gt; || &lt;code&gt;2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x29&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50 || 0x07 || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.50++ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;1D5EFBE7C5D34AD60F9FBC46A5977FCE&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;002CF896D35DB871D0E6A252E799876A70D043C23E&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x08 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13&lt;/code&gt; || &lt;code&gt;5A4CEFD5A9C3C093D0B9352376D19405&lt;/code&gt; || &lt;code&gt;6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x16&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50&lt;/span&gt; || 0x09 || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.50++&lt;/span&gt; || dec || &lt;code&gt;F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B&lt;/code&gt; || &lt;code&gt;F4D535069301EE888CC2A852DB654461&lt;/code&gt; || &lt;code&gt;1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50&lt;/span&gt; || 0x08 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.50 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;908A75754E521EAC2F5A4889C6D7B72D&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x13&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.50 || 0x07 np || 3.50++ || dec || &lt;code&gt;3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3&lt;/code&gt; || &lt;code&gt;E4897BE553AE025CDCBF2B15D1C9234E&lt;/code&gt; || &lt;code&gt;A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E&lt;/code&gt; || &lt;code&gt;009EF86907782A318D4CC3617EBACE2480E73A46F6&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | npdrm || 3.50 || 0x09 np || 3.50++ || dec || &lt;code&gt;0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A&lt;/code&gt; || &lt;code&gt;04AD3C2F122A3B35E804850CAD142C6D&lt;/code&gt; || &lt;code&gt;A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x2A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#ACFCAC; color:#330033;&quot; | app || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55 || 0x0A || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | 3.55+ || dec || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;5D1FAB844107676ABCDFC25EAEBCB633&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0010818ED8A666051C6198662C3D6DDE2CA4901DDC&lt;/code&gt; || style=&quot;background-color:#ACFCAC; color:#330033;&quot; | &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0B || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3&lt;/code&gt; || &lt;code&gt;E4792F2B9DB30CB8D1596077A13FB3B5&lt;/code&gt; || &lt;code&gt;2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55-?&lt;/span&gt; || 0x0C || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.55++&lt;/span&gt; || dec || &lt;code&gt;9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA&lt;/code&gt; || &lt;code&gt;D43B1FA8BE15714B3078C23908BB2BCA&lt;/code&gt; || &lt;code&gt;7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55&lt;/span&gt; || 0x0B np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.55 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;263057225873F83940A65C8C926AC3E4&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.55 || 0x0A np || 3.55++ || dec || &lt;code&gt;03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4&lt;/code&gt; || &lt;code&gt;0A99D4D4F8301A88052D714AD2FB565E&lt;/code&gt; || &lt;code&gt;3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | npdrm || 3.55-? || 0x0C np || 3.55++ || dec || &lt;code&gt;357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92&lt;/code&gt; || &lt;code&gt;D26E6DD2B74CD78E866E742E5571B84F&lt;/code&gt; || &lt;code&gt;00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0D || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194&lt;/code&gt; || &lt;code&gt;5ADB9EAFE897B54CB1060D6885BE22CF&lt;/code&gt; || &lt;code&gt;71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142&lt;/code&gt; || - || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-?&lt;/span&gt; || 0x0E || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03&lt;/code&gt; || &lt;code&gt;90266C98CBAA06C1BF145FF760EA1B45&lt;/code&gt; || &lt;code&gt;84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;app&lt;/span&gt; || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56-? || 0x0F || style=&quot;background-color:#CCFCCC; color:#330033;&quot; | &lt;span style=&quot;background-color:#CCFCCC; color:#330033;&quot;&gt;3.56++&lt;/span&gt; || dec || &lt;code&gt;FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B&lt;/code&gt; || &lt;code&gt;64F50296CF8CF49CD7C643572887DA0B&lt;/code&gt; || &lt;code&gt;0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56&lt;/span&gt; || 0x0E np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.56 only&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;9DED878CB6BA07121C0F50E7B172A8BF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0D np || 3.56++ || dec || &lt;code&gt;337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957&lt;/code&gt; || &lt;code&gt;8405C88E042280DBD794EC7E22B74002&lt;/code&gt; || &lt;code&gt;9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | npdrm || 3.56 || 0x0F np || 3.56++ || dec || &lt;code&gt;135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291&lt;/code&gt; || &lt;code&gt;4070C898C2EAAD1634A288AA547A35A8&lt;/code&gt; || &lt;code&gt;BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x10 || 3.60++ || dec || &lt;code&gt;A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F&lt;/code&gt; || &lt;code&gt;7A203D5112F799979DF0E1B8B5B52AA4&lt;/code&gt; || &lt;code&gt;50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x10 np || 3.60++ || dec || &lt;code&gt;4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61&lt;/code&gt; || &lt;code&gt;C0F2AB86E6E0457552DB50D7219371C5&lt;/code&gt; || &lt;code&gt;64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x11 || 3.60++ || dec || &lt;code&gt;0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD&lt;/code&gt; || &lt;code&gt;97AF39C383E7EF1C98FA447C597EA8FE&lt;/code&gt; || &lt;code&gt;2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x26&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.60-3.61&lt;/span&gt; || 0x11 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.60&amp;nbsp;&amp;lt;=3.61&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;D3A7C3C91CBA014FCBCA6D5570DE13FF&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x23&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.60-3.61 || 0x12 || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715&lt;/code&gt; || &lt;code&gt;25589F01B97B9BE1E07447A3CE7F06B9&lt;/code&gt; || &lt;code&gt;3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3D&lt;/code&gt;<br /> |-<br /> | npdrm || 3.60-3.61 || 0x12 np || =&amp;gt;3.60&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374&lt;/code&gt; || &lt;code&gt;211B52440AB7066A53121106FEB29FD5&lt;/code&gt; || &lt;code&gt;EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x13 np || 3.65++ || dec || &lt;code&gt;265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46&lt;/code&gt; || &lt;code&gt;8DEA5FF959682A9B98B688CEA1EF4A1D&lt;/code&gt; || &lt;code&gt;9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x18&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x13 || 3.65++ || dec || &lt;code&gt;DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94&lt;/code&gt; || &lt;code&gt;CB5DD4BE8CF115FFB25801BC6086E729&lt;/code&gt; || &lt;code&gt;B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x14 || 3.65++ || dec || &lt;code&gt;491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E&lt;/code&gt; || &lt;code&gt;F98843588FED8B0E62D7DDCB6F0CECF4&lt;/code&gt; || &lt;code&gt;04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x27&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.65-3.66&lt;/span&gt; || 0x14 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.65&amp;nbsp;&amp;lt;=3.66&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;22C19C5522F7A782AFC547C2640F5BDE&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x29&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.65-3.66 || 0x15 || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4&lt;/code&gt; || &lt;code&gt;A37B2139FBCF62F6B41F796A594440C8&lt;/code&gt; || &lt;code&gt;A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3A&lt;/code&gt;<br /> |-<br /> | npdrm || 3.65-3.66 || 0x15 np || =&amp;gt;3.65&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F&lt;/code&gt; || &lt;code&gt;ABF2DA36D993554FB060322DC51097F7&lt;/code&gt; || &lt;code&gt;497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x3B&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x16 || 3.70++ || dec || &lt;code&gt;A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C&lt;/code&gt; || &lt;code&gt;62773C70BD749269C0AFD1F12E73909E&lt;/code&gt; || &lt;code&gt;566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x16 np || 3.70++ || dec || &lt;code&gt;7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B&lt;/code&gt; || &lt;code&gt;4AD981431B98DFD39B6388EDAD742A8E&lt;/code&gt; || &lt;code&gt;62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x25&lt;/code&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x17 || 3.70++ || dec || &lt;code&gt;4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46&lt;/code&gt; || &lt;code&gt;954A86C4629E116532304A740862EF85&lt;/code&gt; || &lt;code&gt;3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x08&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;3.70-3.74&lt;/span&gt; || 0x17 np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;3.70&amp;nbsp;&amp;lt;=3.74&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;FC5FA12CA3D2D336C4B8B425D679DA55&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x15&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 3.70-3.74 || 0x18 || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997&lt;/code&gt; || &lt;code&gt;BF8D6B1887FA88E6D85C2EDB2FBEC147&lt;/code&gt; || &lt;code&gt;64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x11&lt;/code&gt;<br /> |-<br /> | npdrm || 3.70-3.74 || 0x18 np || =&amp;gt;3.70&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133&lt;/code&gt; || &lt;code&gt;402666C76D795D228089810DDC128D14&lt;/code&gt; || &lt;code&gt;ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x15&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x19 || 4.00++ || dec || &lt;code&gt;3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297&lt;/code&gt; || &lt;code&gt;6153DEE781B8ADDC6A439498B816DC46&lt;/code&gt; || &lt;code&gt;148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x31&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x19 np || 4.00++ || dec || &lt;code&gt;FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3&lt;/code&gt; || &lt;code&gt;F72C1D80FFDA2E3BF085F4133E6D2805&lt;/code&gt; || &lt;code&gt;637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x24&lt;/code&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1A || 4.00++ || dec || &lt;code&gt;5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9&lt;/code&gt; || &lt;code&gt;1AC8FA3B3C90F8FDE639515F91B58327&lt;/code&gt; || &lt;code&gt;BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;npdrm&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.00-4.11&lt;/span&gt; || 0x1A np || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;=&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;23AE4ADA4D3F798DC5ED98000337FF77&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x1A&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> | app || 4.00-4.11 || 0x1B || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B&lt;/code&gt; || &lt;code&gt;9F7B5713A5ED59F6B35CD8F8A165D4B8&lt;/code&gt; || &lt;code&gt;4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x12&lt;/code&gt;<br /> |-<br /> | npdrm || 4.00-4.11 || 0x1B np || =&amp;gt;4.00&amp;nbsp;&amp;lt;=4.11 || dec || &lt;code&gt;BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B&lt;/code&gt; || &lt;code&gt;D03979E47D236BD278EC7331B7DA0BD4&lt;/code&gt; || &lt;code&gt;4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x17&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1C || 4.20++ || dec || &lt;code&gt;CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752&lt;/code&gt; || &lt;code&gt;FD40664E2EBBA01BF359B0DCDF543DA4&lt;/code&gt; || &lt;code&gt;36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x09&lt;/code&gt;<br /> |-<br /> | npdrm || 4.20-{{latest}} || 0x1C np || 4.20++ || dec || &lt;code&gt;8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F&lt;/code&gt; || &lt;code&gt;246F4B8328BE6A2D394EDE20479247C5&lt;/code&gt; || &lt;code&gt;503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x30&lt;/code&gt;<br /> |-<br /> | app || 4.20-{{latest}} || 0x1D || 4.20++ || dec || &lt;code&gt;D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E&lt;/code&gt; || &lt;code&gt;ACB9945914EBB7B9A31ECE320AE09F2D&lt;/code&gt; || &lt;code&gt;430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879&lt;/code&gt; || &lt;code&gt;&lt;/code&gt; || &lt;code&gt;0x1A&lt;/code&gt;<br /> |-<br /> | style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;seven&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20-{{latest}}&lt;/span&gt; || not &quot;0x1E&quot; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;4.20++&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;dec&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;BF036387CDB613C0AC88A6D9D2CC5316&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;&lt;/code&gt;&lt;/span&gt; || style=&quot;background-color:lightgrey;&quot; | &lt;span style=&quot;background-color:lightgrey;&quot;&gt;&lt;code&gt;0x0F&lt;/code&gt;&lt;/span&gt;<br /> |-<br /> |}<br /> <br /> === klicensee ===<br /> <br /> ==== klic_dec_key ==== <br /> klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE<br /> See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg<br /> <br /> klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3<br /> <br /> ==== klic_dev_key ====<br /> Found inside ps1_netemu.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1<br /> <br /> ==== klic_free_key ====<br /> see NPDRM OMAC Keys<br /> klic_free_key : 72F990788F9CFF745725F08E4C128387<br /> <br /> ==== RIF's act.dat index decryption key ====<br /> actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B<br /> Actually in vsh.self<br /> <br /> ==== riv_key ====<br /> riv_key : 00000000000000000000000000000000<br /> (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also [https://www.das-labor.org/trac/browser/microcontroller-2/crypto-lib/testvectors/Sha-1-160.test-vectors :/])<br /> Actually in appldr<br /> <br /> ==== klicensee constant ====<br /> klicensee_const : 5E06E04FD94A71BF0000000000000001<br /> Actually in lv2_kernel.self<br /> <br /> ==== klicensee(psp) ====<br /> Found inside psp_emulator.self &lt;br /&gt;<br /> Used as klicensee for ISO.BIN.EDAT<br /> <br /> klicensee for psp minis:<br /> <br /> klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E<br /> <br /> klicensee for psp remasters:<br /> <br /> klic_pe : 0DB85732366CD734FC879E743343BB4F<br /> <br /> ==== vsh pub + curvetable ====<br /> pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B<br /> curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000<br /> 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06<br /> 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92<br /> F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF<br /> FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1<br /> 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520<br /> inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF<br /> FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9<br /> FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D<br /> 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000<br /> 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E<br /> 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF<br /> <br /> Notes:&lt;br /&gt;<br /> *It is used for rif/act.dat signatures, for example.&lt;br /&gt;<br /> <br /> [http://www.multiupload.com/A19Q0HV7OW vsh-pub-curves.rar (367 Bytes)]<br /> <br /> == Snowden Key (in vsh.elf or vshnet.prx into old firmwares) ==<br /> 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A <br /> 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 <br /> 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 <br /> 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397<br /> <br /> == VSH CryptoEngine Sha1Hmac keys ==<br /> key0 685E2534695D79096F57640044315B515E0C7E55<br /> key1 46753933634D1A1D464142752110116F2C5E7836<br /> key2 59CB6067574D873CEFD7B75A300529C18BFB75ED<br /> key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2<br /> key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5<br /> key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48<br /> key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA<br /> key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933<br /> <br /> == NPDRM stuff ==<br /> &lt;!--// needs some logical reordering in module subsection //--&gt;<br /> http://img24.imageshack.us/img24/9083/snapshote.png<br /> <br /> ==== GPKG/SELF ECDSA signature ====<br /> Public key: &lt;code&gt;E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9&lt;/code&gt;&lt;br /&gt;<br /> Public bak: &lt;code&gt;D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh)&lt;br /&gt;<br /> <br /> ==== NPDRM OMAC Keys ====<br /> npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387<br /> npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B<br /> npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97<br /> <br /> == PSISOIMG0000 ==<br /> See also : [[PSISOIMG0000]]&lt;br /&gt;<br /> <br /> Public key: <br /> &lt;code&gt;948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773&lt;/code&gt;&lt;br /&gt;<br /> Private key: <br /> &lt;code&gt;00bf21224b041f29549db25e9aade19e720a1fe0f1&lt;/code&gt;&lt;br /&gt;<br /> Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)&lt;br /&gt;<br /> This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.<br /> <br /> location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡&gt;Œ¯Õº..ÎCDa»2<br /> 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.Ó­O[bG§ý<br /> 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs<br /> <br /> == DOCUMENT.DAT ==<br /> des key: 39F7EFA16CCE5F4C<br /> <br /> des iv: A819C4F5E154E30B<br /> Location: ps1_netemu.self<br /> <br /> == PS2 Keys ==<br /> MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A &lt;-mc_iso<br /> MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 &lt;-mc_iso<br /> MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 &lt;-mc_iso<br /> MC_CHALLENGE_MATERIAL 2C5BF48D32749127 &lt;-mc_iso<br /> MG_KBIT_MATERIAL 35C860019222BB60 &lt;-me_iso<br /> MG_KC_MATERIAL 8C2BD03EC245C56D &lt;-me_iso<br /> MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 &lt;- me_iso<br /> MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 &lt;- me_iso<br /> META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 &lt;- sb_iso<br /> DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 &lt;- sb_iso<br /> VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 &lt;- sb_iso<br /> META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 &lt;- sb_iso <br /> DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 &lt;- sb_iso <br /> VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 &lt;- sb_iso<br /> <br /> == KIRK ==<br /> <br /> * Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.<br /> <br /> '''see also:'''<br /> * https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication<br /> * https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c<br /> * http://wololo.net/talk/viewtopic.php?f=6&amp;t=7224<br /> * http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [https://github.com/codestation/mhtools/blob/master/src/jpcsp/crypto/CryptoEngine.java] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [https://github.com/codestation/mhtools/tree/master/src/keys]<br /> <br /> === Private-Public Crypto ===<br /> <br /> // KIRK CMD1 ECDSA Private Key<br /> kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D<br /> <br /> // PSP EDAT ECDSA Private Key<br /> edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD<br /> <br /> // NPUMDIMG ECDSA Private Key<br /> priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970<br /> <br /> // KIRK1 ECDSA Private Key<br /> kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 <br /> kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39<br /> <br /> // PSP EDAT ECDSA Public Key<br /> edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521<br /> edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D<br /> <br /> // NPUMDIMG ECDSA Public Key<br /> npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B<br /> npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B<br /> <br /> /* ECC Curves for Kirk 1 and Kirk 11 */<br /> // Common Curve paramters p and a<br /> ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF<br /> ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon<br /> <br /> // Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service<br /> // Since public key is variable, it is not specified here<br /> ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon<br /> ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127<br /> Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C <br /> Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF <br /> <br /> // KIRK 1 - Unique curve parameters for b, N, and base point G<br /> // Since public key is hard coded, it is also included<br /> <br /> ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9<br /> ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F<br /> Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA <br /> Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0<br /> <br /> === Private Crypto ===<br /> <br /> // KIRK CMD1 AESCBC128-CMAC key<br /> kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA<br /> <br /> // KIRK CMD4 and CMD7 AESCBC128 key table<br /> kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3<br /> kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668<br /> kirk7_key04 = 99244CD258F51BCBB0619CA73830075F<br /> kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17<br /> kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3<br /> kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018<br /> kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E<br /> kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882<br /> kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03<br /> kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371<br /> kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A<br /> kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D<br /> kirk7_key38 = 12468D7E1C42209BBA5426835EB03303<br /> kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A<br /> kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA<br /> kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3<br /> kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin<br /> kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6<br /> kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870<br /> kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F<br /> kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582<br /> kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 <br /> <br /> //KIRK Unknown 100 key<br /> kirk_unk100 = 000102030405060708090A0B0C0D0E0F<br /> <br /> // KIRK CMD0x10 key<br /> kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A<br /> <br /> // CHNNLSV SaveData keys<br /> sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C<br /> sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF<br /> sdHashKey3 = 36A53EACC5269EA383D9EC256C484872<br /> sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203<br /> sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86<br /> sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B<br /> sdHashKey7 = EC6D29592635A57F972A0DBCA3263300<br /> <br /> // AMCTRL keys<br /> amHashKey1 = 9C48B62840E6533F05113A4E65E63A64<br /> amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C<br /> amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB<br /> amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445<br /> amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E<br /> <br /> ==Idpstealer Key?==<br /> <br /> DES encrypt 192? bit<br /> 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000<br /> <br /> === Idpstealer Key Confusion ===<br /> <br /> * here's the executable (with printf) :<br /> https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM<br /> * here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w<br /> * here's the specific function : http://pastie.org/10530594<br /> * usage: &lt;code&gt; idpstealer.exe idps.bin &lt;/code&gt;<br /> * output: &lt;code&gt; SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E &lt;/code&gt;<br /> <br /> ==Sbox Values==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! D/L !! hex !! Note <br /> |-<br /> | [http://www.multiupload.com/B5F336G4UF] <br /> | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v<br /> 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ<br /> 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&amp;6?÷Ì4¥åñqØ1.<br /> 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u<br /> 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„<br /> 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ<br /> 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P&lt;Ÿ¨<br /> 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ<br /> 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s<br /> 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ&quot;*.ˆFî¸.Þ^.Û<br /> 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy<br /> 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®.<br /> 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š<br /> 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p&gt;µfH.ö.a5W¹†Á.ž<br /> 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß<br /> 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».<br /> | Present in all SPU binaries that perform AES (see [http://www.psdevwiki.com/ps3/AES_binaries here])<br /> |-<br /> | <br /> | Inverse AES S-box<br /> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> <br /> 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы<br /> 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ<br /> 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN<br /> 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С%<br /> 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’<br /> 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„<br /> 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE.<br /> 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk<br /> 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs<br /> 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t&quot;з.5…вщ7и.uЯn<br /> 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ.<br /> 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV&gt;KЖТy љЫАюxНZф<br /> 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_<br /> 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп<br /> 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61  а;M®*х°Ил»&lt;ѓS™a<br /> 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&amp;бi.cU!.}<br /> |<br /> |-<br /> |}<br /> <br /> in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145<br /> <br /> == RCON ==<br /> 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00<br /> 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00<br /> 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00<br /> 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00<br /> 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00<br /> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00<br /> 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00<br /> 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00<br /> 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00<br /> 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00<br /> <br /> == Shuffles ==<br /> 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F<br /> 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10<br /> 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11<br /> 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12<br /> 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13<br /> 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14<br /> 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15<br /> 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16<br /> 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17<br /> 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18<br /> 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19<br /> 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A<br /> 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B<br /> 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C<br /> 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D<br /> 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E<br /> 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F<br /> <br /> == ShiftRows tab ==<br /> 00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B<br /> 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C<br /> 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01<br /> 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06<br /> <br /> == InvShiftRows tab ==<br /> 00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03<br /> 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C<br /> 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09<br /> 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06<br /> <br /> == Td0/Te1 ==<br /> <br /> See [[https://invgen.googlecode.com/git-history/53549121c5b903c31cbae01b0cfeaa985035a4a5/Benchmarks/aes/aes_orig/aes_orig_hex2dec.py this]] and [[http://psdevwiki.com/ps3/AES_binaries binaries]] with sbox repeated 4 times<br /> <br /> == T5 ==<br /> Inside lv2_kernel<br /> see [[https://github.com/cforler/Ada-Crypto-Library/blob/master/src/crypto-symmetric-algorithm-aes-tables.ads this ]]<br /> <br /> {{Reverse engineering}}&lt;noinclude&gt;[[Category:Main]]&lt;/noinclude&gt;</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Talk:Syscon_Hardware&diff=44078 Talk:Syscon Hardware 2017-05-11T16:51:27Z <p>93.108.187.41: /* PS2 Mechacon vs PS3 Syscon vs PS4 Syscon */</p> <hr /> <div>== Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package) ==<br /> In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:<br /> *&quot;&quot;&quot;pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))&quot;&quot;&quot;<br /> In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked:<br /> http://666kb.com/i/cnj3qic8k412x3p8r.jpg<br /> <br /> *All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)<br /> <br /> If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)<br /> <br /> == PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc ==<br /> There is no seperate communication processor on the PS3. Powering is handled by syscon.<br /> <br /> *Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)<br /> <br /> == Multipage Correction ==<br /> &lt;TizzyT&gt; eussnl my syscon is CXR714120-301GB its different form what the wiki says<br /> CECHH / DIA-001<br /> <br /> === Package ===<br /> http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA<br /> <br /> ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads<br /> <br /> new QF package is 26 * 38 = 128 pins<br /> <br /> === Clocks ===<br /> SysCon clocks:<br /> T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz<br /> C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz<br /> http://oi52.tinypic.com/2s9ziw0.jpg<br /> <br /> === Backup Mode / Diag ===<br /> BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low.<br /> Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.<br /> <br /> ----<br /> <br /> SEM-001 CECHG<br /> Pink is N15 BACKUP_MODE<br /> Blue is N16 DIAG_MODE<br /> picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg<br /> source: http://psx-scene.com/forums/780185-post344.html !unverified!<br /> <br /> According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg<br /> These pins are tied to 3.3v so grounding them should enable each mode respectively.<br /> !unverified!<br /> <br /> ----<br /> === SoftID ===<br /> ''Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are &gt;4 pages describing SELF :/)''<br /> <br /> a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.&lt;br /&gt;<br /> This info can be get through the [[More System Information]] method.&lt;br /&gt;<br /> You can find them also inside the SYS_CON_FIRMWARE_*********.pkg ([[Syscon_Firmware]]) at the offset '''0x28E''' (In this link you can found the list of the [[Syscon_Firmware#Known_Retail_syscon_update_packages| Syscon update packages]])&lt;br /&gt;<br /> every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ([[Syscon_Hardware#Serialnumbers_.40_SKU| Syscon Hardware]])<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! SoftID !! SC Generation !! notes<br /> |-<br /> ! colspan=&quot;4&quot; id=&quot;null&quot;| Phats<br /> |-<br /> | 0B8E || 1 || -<br /> |-<br /> | 0C16 || 2 || -<br /> |-<br /> | 0D52 || 3 || -<br /> |-<br /> | 0DBF || 4 || -<br /> |-<br /> | 0E69 || 5 || -<br /> |-<br /> | 0F29 || 6 || -<br /> |-<br /> | 0F38 || 7 || -<br /> |-<br /> | 065D || 8 || -<br /> |-<br /> ! colspan=&quot;4&quot; id=&quot;null&quot;| Slims<br /> |-<br /> | 0832 || 9 || -<br /> |-<br /> | 08C2 || 10 || -<br /> |-<br /> | 0918 || 11 || -<br /> |-<br /> |}<br /> <br /> === Datasheet of SoC similar to syscon ===<br /> * [http://www.alldatasheet.com/datasheet-pdf/pdf/294279/SONY/CXR704060.html Sony CXR704060 datasheet.pdf] [http://mir.cr/LJOMNBFO mirror]<br /> <br /> == COK-002 with 0DBF syscon ==<br /> <br /> Information:<br /> https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg<br /> <br /> Min ver:<br /> https://lh5.googleusercontent.com/-iUOuidm6v3g/UexEQily6TI/AAAAAAAAGOk/zSfBMpYDRAM/s800/TV2013072117272000.jpg<br /> <br /> Board type:<br /> https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG<br /> <br /> Syscon:<br /> https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG<br /> <br /> <br /> '''Talk'''<br /> <br /> -This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... [[Talk:More_System_Information | check SoftID examples in this table]]) --[[User:Sandungas|Sandungas]] 22:07, 24 July 2013 (MSK)<br /> <br /> -The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira<br /> <br /> <br /> == SHA1 hashes stored at eeprom ==<br /> <br /> from http://www.edepot.com/playstation3.html<br /> <br /> &quot;Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. &quot;<br /> <br /> What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)<br /> <br /> == PS2 Mechacon vs PS3 Syscon vs PS4 Syscon ==<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> ! PS2 Mechacon !! PS3 Syscon !! PS4 Syscon !! Real IC/CPU Core<br /> |-<br /> | CXP101064 || - || - || rowspan=&quot;3&quot; | Sony SPC900 (100 pin)<br /> |-<br /> | CXP102064 || - || -<br /> |-<br /> | CXP103049 || - || -<br /> |- bgcolor=&quot;#CCCCCC&quot;<br /> | colspan=&quot;4&quot; |<br /> |-<br /> | CXR706080 || - || - || rowspan=&quot;3&quot; | Sony SR11? (164 (PS2) / 200 (PS3) pin) (SONY'04 seems to denote it was manufactured in 2004) &lt;!-- CXR704060 data sheet --&gt;<br /> |-<br /> | CXR716080 || CXR713120 || -<br /> |-<br /> | CXR726080 || CXR714120 || -<br /> |- bgcolor=&quot;#CCCCCC&quot;<br /> | colspan=&quot;4&quot; |<br /> |-<br /> | - || SW || - || rowspan=&quot;2&quot; | Chip Similar to G13(PS3) (128 pin)<br /> |-<br /> | - || SW2 || -<br /> |-<br /> | - || rowspan=&quot;3&quot; | SW3 || A00 || rowspan=&quot;3&quot; | Renesas RL78/G13 (100 pin) &lt;- PS4 / Chip Similar to G13(PS3) (100 pin)<br /> |-<br /> | - || A01<br /> |-<br /> | - || A02<br /> |-<br /> |}<br /> <br /> * https://www.renesas.com/en-eu/about/press-center/news/2010/news20101117.html<br /> * https://maru-chang.com/hard/scph/index.php/consoles/english/ (SCPH50000 release had Dragon Mechacon - late 2004)</div> 93.108.187.41 http://www.psdevwiki.com/ps3/index.php?title=Talk:Syscon_Hardware&diff=44077 Talk:Syscon Hardware 2017-05-11T16:47:20Z <p>93.108.187.41: /* PS2 Mechacon vs PS3 Syscon vs PS4 Syscon */</p> <hr /> <div>== Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package) ==<br /> In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:<br /> *&quot;&quot;&quot;pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))&quot;&quot;&quot;<br /> In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked:<br /> http://666kb.com/i/cnj3qic8k412x3p8r.jpg<br /> <br /> *All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)<br /> <br /> If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)<br /> <br /> == PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc ==<br /> There is no seperate communication processor on the PS3. Powering is handled by syscon.<br /> <br /> *Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)<br /> <br /> == Multipage Correction ==<br /> &lt;TizzyT&gt; eussnl my syscon is CXR714120-301GB its different form what the wiki says<br /> CECHH / DIA-001<br /> <br /> === Package ===<br /> http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA<br /> <br /> ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads<br /> <br /> new QF package is 26 * 38 = 128 pins<br /> <br /> === Clocks ===<br /> SysCon clocks:<br /> T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz<br /> C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz<br /> http://oi52.tinypic.com/2s9ziw0.jpg<br /> <br /> === Backup Mode / Diag ===<br /> BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low.<br /> Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.<br /> <br /> ----<br /> <br /> SEM-001 CECHG<br /> Pink is N15 BACKUP_MODE<br /> Blue is N16 DIAG_MODE<br /> picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg<br /> source: http://psx-scene.com/forums/780185-post344.html !unverified!<br /> <br /> According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg<br /> These pins are tied to 3.3v so grounding them should enable each mode respectively.<br /> !unverified!<br /> <br /> ----<br /> === SoftID ===<br /> ''Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are &gt;4 pages describing SELF :/)''<br /> <br /> a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.&lt;br /&gt;<br /> This info can be get through the [[More System Information]] method.&lt;br /&gt;<br /> You can find them also inside the SYS_CON_FIRMWARE_*********.pkg ([[Syscon_Firmware]]) at the offset '''0x28E''' (In this link you can found the list of the [[Syscon_Firmware#Known_Retail_syscon_update_packages| Syscon update packages]])&lt;br /&gt;<br /> every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ([[Syscon_Hardware#Serialnumbers_.40_SKU| Syscon Hardware]])<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> |-<br /> ! SoftID !! SC Generation !! notes<br /> |-<br /> ! colspan=&quot;4&quot; id=&quot;null&quot;| Phats<br /> |-<br /> | 0B8E || 1 || -<br /> |-<br /> | 0C16 || 2 || -<br /> |-<br /> | 0D52 || 3 || -<br /> |-<br /> | 0DBF || 4 || -<br /> |-<br /> | 0E69 || 5 || -<br /> |-<br /> | 0F29 || 6 || -<br /> |-<br /> | 0F38 || 7 || -<br /> |-<br /> | 065D || 8 || -<br /> |-<br /> ! colspan=&quot;4&quot; id=&quot;null&quot;| Slims<br /> |-<br /> | 0832 || 9 || -<br /> |-<br /> | 08C2 || 10 || -<br /> |-<br /> | 0918 || 11 || -<br /> |-<br /> |}<br /> <br /> === Datasheet of SoC similar to syscon ===<br /> * [http://www.alldatasheet.com/datasheet-pdf/pdf/294279/SONY/CXR704060.html Sony CXR704060 datasheet.pdf] [http://mir.cr/LJOMNBFO mirror]<br /> <br /> == COK-002 with 0DBF syscon ==<br /> <br /> Information:<br /> https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg<br /> <br /> Min ver:<br /> https://lh5.googleusercontent.com/-iUOuidm6v3g/UexEQily6TI/AAAAAAAAGOk/zSfBMpYDRAM/s800/TV2013072117272000.jpg<br /> <br /> Board type:<br /> https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG<br /> <br /> Syscon:<br /> https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG<br /> <br /> <br /> '''Talk'''<br /> <br /> -This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... [[Talk:More_System_Information | check SoftID examples in this table]]) --[[User:Sandungas|Sandungas]] 22:07, 24 July 2013 (MSK)<br /> <br /> -The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira<br /> <br /> <br /> == SHA1 hashes stored at eeprom ==<br /> <br /> from http://www.edepot.com/playstation3.html<br /> <br /> &quot;Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. &quot;<br /> <br /> What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)<br /> <br /> == PS2 Mechacon vs PS3 Syscon vs PS4 Syscon ==<br /> <br /> {| class=&quot;wikitable sortable&quot;<br /> ! PS2 Mechacon !! PS3 Syscon !! PS4 Syscon !! Real IC/CPU Core<br /> |-<br /> | CXP101064 || - || - || rowspan=&quot;3&quot; | Sony SPC900 (100 pin)<br /> |-<br /> | CXP102064 || - || -<br /> |-<br /> | CXP103049 || - || -<br /> |- bgcolor=&quot;#CCCCCC&quot;<br /> | colspan=&quot;4&quot; |<br /> |-<br /> | CXR706080 || - || - || rowspan=&quot;3&quot; | Sony SR11? (164 (PS2) / 200 (PS3) pin) (SONY'04 seems to denote it was manufactured in 2004) &lt;!-- CXR704060 data sheet --&gt;<br /> |-<br /> | CXR716080 || CXR713120 || -<br /> |-<br /> | CXR726080 || CXR714120 || -<br /> |- bgcolor=&quot;#CCCCCC&quot;<br /> | colspan=&quot;4&quot; |<br /> |-<br /> | - || SW || - || rowspan=&quot;2&quot; | Chip Similar to G13(PS3) (128 pin)<br /> |-<br /> | - || SW2 || -<br /> |-<br /> | - || rowspan=&quot;3&quot; | SW3 || A00 || rowspan=&quot;3&quot; | Renesas RL78/G13 (100 pin) &lt;- PS4 / Chip Similar to G13(PS3) (100 pin)<br /> |-<br /> | - || A01<br /> |-<br /> | - || A02<br /> |-<br /> |}<br /> <br /> * https://www.renesas.com/en-eu/about/press-center/news/2010/news20101117.html</div> 93.108.187.41