Editing ENCDEC Device Reverse Engineering

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
=Introduction=
=Introduction=


* ENCDEC is the encoder/decoder, integrated inside [[South Bridge]]
* The following information was reverse engineered from LV1, Storage Manager in LPAR1, sb_iso_spu_module.self and sv_iso_spu_module.self.
* The following information was reverse engineered from LV1, Storage Manager in LPAR1, sb_iso_spu_module.self and sv_iso_spu_module.self.


Line 26: Line 25:
* Before a secure communication channel is established, host and ENCDEC device use static AES-CBC-192 keys to encrypt communication data. The static keys can be found e.g. in sb_iso_spu_module.self or sv_iso_spu_module.self.
* Before a secure communication channel is established, host and ENCDEC device use static AES-CBC-192 keys to encrypt communication data. The static keys can be found e.g. in sb_iso_spu_module.self or sv_iso_spu_module.self.
* Static ENCDEC keys depend on SB bus version. To get your SB bus version, read v2 of repository node SB bus id.
* Static ENCDEC keys depend on SB bus version. To get your SB bus version, read v2 of repository node SB bus id.
SB bus id from 3.15:
<pre>
....bus. 00 00 00 00 62 75 73 01
id...... 69 64 00 00 00 00 00 00
........ 00 00 00 00 00 00 00 00
........ 00 00 00 00 00 00 00 00
........ 00 00 00 00 00 00 00 01
........ 00 00 00 00 03 00 01 03        <-------- SB bus id v2
# Dumping it with ps3lv1call-tools
~/ps3lv1call-tools$ sudo ./ps3lv1call 91 1 0x0000000062757301 0x6964000000000000 0 0
0000000000000001 0000000004000103
</pre>
* During the communication, host and ENCDEC device use random IVs which are sent unencrypted together with encrypted payload.
* During the communication, host and ENCDEC device use random IVs which are sent unencrypted together with encrypted payload.
* The ENCDEC commands, which are encrypted with the session key, contain magic 24 bytes which are checked by ENCDEC device and if some bits are not correct then the command is denied. The magic bytes can be found in sb_iso_spu_module.self too.
* The ENCDEC commands, which are encrypted with the session key, contain magic 24 bytes which are checked by ENCDEC device and if some bits are not correct then the command is denied. The magic bytes can be found in sb_iso_spu_module.self too.
Line 61: Line 45:
* Used by host to send ENCDEC command to ENCDEC device.
* Used by host to send ENCDEC command to ENCDEC device.
* Sent data is encrypted with the session key.
* Sent data is encrypted with the session key.
* It contains magic 24 bytes from sb_iso_spu_module.self.


==KGEN_FLASH (0x84)==
==KGEN_FLASH (0x84)==
Line 75: Line 58:


=Set ENCDEC Keys=
=Set ENCDEC Keys=
=Linux Application=
* Here the Linux application i use with my ps3encdec device driver to set/clear ATA/ENCDEC keys on my PS3.
See my GIT repo: http://gitorious.ps3dev.net/ps3linux/encdec
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)