Editing Seeds

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= Source of the PS3 seeds =
= Information about these seeds =


The seeds presented on this page were acquired through different means. It started with a simple search (which I have to thank glevand and naehrwert for, as had it not been for those guys, I wouldn't have found myself the confidence to post this) and it went through several people who helped me along the way, and who probably wish to stay anonymous.
The seeds present on this wiki page were acquired through different means. It started with a simple search (Which i have to thank glevand and naehrwert for, as had it not been for those guys, i wouldn't have found myself the confidence to post this) and it went through several people who helped me along the way, and that probably wish to stay anonymous.


= Seeds =
Without further ado, here are the seeds (both known and unknown) for several functions of the ps3.


== Common ==
== Common ==
Line 10: Line 10:


<pre>
<pre>
59302145AC09B1EFE69E9B7A25FF8F86
59 30 21 45 AC 09 B1 EF E6 9E 9B 7A 25 FF 8F 86
E9F6814D37DE204D29729B8416BAEDE4
E9 F6 81 4D 37 DE 20 4D 29 72 9B 84 16 BA ED E4
227098657F298CDB6A9B5E59E4A4BA2F
22 70 98 65 7F 29 8C DB 6A 9B 5E 59 E4 A4 BA 2F
8E6A740E1FC1E3E935DDD2F66CDEDD6B
8E 6A 74 0E 1F C1 E3 E9 35 DD D2 F6 6C DE DD 6B
</pre>
</pre>


* Used on old firmwares, possibly for an old EID0 format (or fallback?) which can be 0x20 or 0x28 bytes in size. Decrypted section is always the same.
Used on old firmwares, possible for an old EID0 format (or fallback?) which can be 0x20 or 0x28 bytes in size. Decrypted section is always the same, see comments: http://pastie.org/private/rzg83pokd4vnxg60dj3qwg
* See [https://web.archive.org/web/20141118235214/http://pastie.org/private/rzg83pokd4vnxg60dj3qwg comments].
 
* Location: isoldr/appldr/lv1ldr
Taken from: isoldr/appldr/lv1ldr


== eEID ==
== eEID ==


=== EID0 ===
=== eid0 ===


==== EID0 individuals seed ====
==== eid0 individuals seed ====


<pre>
<pre>
ABCAAD1771EFABFC2B921276FAC2130C
AB CA AD 17 71 EF AB FC 2B 92 12 76 FA C2 13 0C
37A6BE3FEF82C79F3BA5733FC35A690B
37 A6 BE 3F EF 82 C7 9F 3B A5 73 3F C3 5A 69 0B
08B358F970FA16A3D2FFE2299E841EE4
08 B3 58 F9 70 FA 16 A3 D2 FF E2 29 9E 84 1E E4
D3DB0E0C9BAEB51BC7DFF10467472F85
D3 DB 0E 0C 9B AE B5 1B C7 DF F1 04 67 47 2F 85
</pre>
</pre>


* Location: aim_spu_module.self/isoldr/appldr/lv1ldr/spu_token_processor.self/spu_utoken_processor.self
Taken from: aim_spu_module.self/isoldr/appldr/lv1ldr/spu_token_processor.self/spu_utoken_processor.self


==== EID0 section 0 seed for enc/dec + CMAC (Kirk command 0x12) ====
==== eid0 keyseed 0x0 ====


<pre>2ED7CE8D1D55454585BF6A3281CD03AF</pre>
<pre>
2E D7 CE 8D 1D 55 45 45 85 BF 6A 32 81 CD 03 AF
</pre>


* Location: aim_spu_module.self
Taken from: aim_spu_module.self


==== EID0 section 6 seed for enc/dec + CMAC (Kirk command 0x12) ====
==== eid0 keyseed 0x6 ====


<pre>3AB0E6C4ACFFB629362FFBBBDBC854BC</pre>
<pre>
3A B0 E6 C4 AC FF B6 29 36 2F FB BB DB C8 54 BC
</pre>


* Location: pspemudrm (KIRK)
Taken from: pspemudrm (kirk)


==== EID0 section 0xA seed for enc/dec + CMAC (Kirk command 0x12) ====
==== eid0 keyseed 0xA ====


<pre>30B0395DC5835AAA3A7986B44AFAE684</pre>
<pre>
30 B0 39 5D C5 83 5A AA 3A 79 86 B4 4A FA E6 84
</pre>


* Location: aim_spu_module.self
Taken from: aim_spu_module.self


==== EID0 section 6 seed for encrypted ECDSA private key (Kirk command 0x10) ====
=== eid1 ===


<pre>33793B9F79E2EBAE55D4D6BF0ED376E6</pre>
==== eid1 individuals seed ====


Notes:
<pre>
* This seed is the equivalent of the PSP Kirk command 0x10 AES128ECB seed (idskey0).
B0 D6 55 76 4C 3B 44 B3 38 F3 2D D1 D0 99 9B 66
* EID0 sections 7-0xA use a different and unknown seed.
48 A3 5A 2C EB 15 E2 8E EC DC 2D C0 B4 C7 EB 05
 
DC 82 25 C0 D5 78 9D BB 2E 89 A2 4A 78 58 58 00
1) aes-256-ecb encrypt the seed with per-console EID0_key (indiv+0x20) and EID0_iv (indiv+0x10), in order to obtain the 128bit decryption key to decrypt per-console encrypted ECDSA private key.
72 36 38 34 EE 1A 11 6C 2C D2 5E 58 EE 67 63 F7
</pre>


2) aes-128-cbc decrypt with iv=0 the encrypted ECDSA private key, located at certificate offset 0x88.
Taken from: sc_iso.self/sc_iso_factory.self


3) Verify the ECDSA private key by using the ECDSA public key at certificate offset 0x10. See KIRK command 0x10 on PSP or PS3 wiki (same constant public key and curve).
=== eid2 ===


* Location: pspemudrm (KIRK)
==== eid2 individuals seed ====
 
=== EID1 ===
 
==== EID1 individuals seed (SD) ====


<pre>
<pre>
0AB7611E56DA45076B46129718F5C80E
74 92 E5 7C 2C 7C 63 F4 49 42 26 8F B4 1C 58 ED
80BFFBA1800145BF2F1C02F7C011FDE8
66 83 41 F9 C9 7B 29 83 96 FA 9D 82 07 51 99 D8
E486A45215B5FFFF432DD7F7DFF0C47D
BC 1A 93 4B 37 4F A3 8D 46 AF 94 C7 C3 33 73 B3
989ADED904DD987FC93BD735DA114397
09 57 20 84 FE 2D E3 44 57 E0 F8 52 7A 34 75 3D
</pre>
</pre>


* Location: {{SD}} sc_iso.self/sc_iso_factory.self
Taken from: fdm_spu_module.self
 
==== EID1 individuals seed ====


==== eid2 DES key ====
<pre>
<pre>
B0D655764C3B44B338F32DD1D0999B66
6C CA B3 54 05 FA 56 2C
48A35A2CEB15E28EECDC2DC0B4C7EB05
DC8225C0D5789DBB2E89A24A78585800
72363834EE1A116C2CD25E58EE6763F7
</pre>
</pre>


* Location: sc_iso.self/sc_iso_factory.self/ss_sc_init.self
Taken from: fdm_spu_module.self


==== Time EID1 seed ====
==== eid2 DES iv ====


<pre>
<pre>
A8DCAB3577F30F7B81C788B80446B03F
00 00 00 00 00 00 00 00
C240BD9F72BBFC7268E4E688C1C24F6E
</pre>  
EF100F2B53199715A99C3E4794487073
74CE56F619FBD2486115A2FBA4F5FBB4
</pre>


* Location: from all decrypted EID1, offset 0x110, size 0x40
Taken from: fdm_spu_module.self


=== EID2 ===
=== eid3 ===


==== EID2 individuals seed ====
==== eid3 individuals seed ====


<pre>
<pre>
7492E57C2C7C63F44942268FB41C58ED
01 D0 49 6A 3B AD D1 73 55 70 CB 29 E1 6F A2 31
668341F9C97B298396FA9D82075199D8
4F A9 FD 1A BA 19 A1 C6 9E EA 2F 4A A6 07 A7 1C
BC1A934B374FA38D46AF94C7C33373B3
6F E2 3E F8 DF BB 0F 2D 9D 45 2C D5 FA D5 8B 74
09572084FE2DE34457E0F8527A34753D
5B F8 A4 A5 0D 8B DB 29 B2 F4 BF 14 C4 4A DD 76
</pre>
</pre>


* Location: fdm_spu_module.self
Taken from: CprmModule.spu.isoself


==== EID2 DES key ====
==== eid3 keyseed ====


<pre>6CCAB35405FA562C</pre>
<pre>
 
5F FF 3F D8 1E 18 B9 56 DA E4 E6 D3 36 82 97 EF
* Location: Lv2diag.self for BD remarry
</pre>


==== EID2 DES IV ====
Taken from: CprmModule.spu.isoself


<pre>0000000000000000</pre>
==== eid3 static key ====
 
* Location: Lv2diag.self for BD remarry
 
=== EID3 ===
 
==== EID3 individuals seed ====


<pre>
<pre>
01D0496A3BADD1735570CB29E16FA231
D9 94 06 CA 4B F3 07 50 43 6A 45 47 36 83 45 89
4FA9FD1ABA19A1C69EEA2F4AA607A71C
6FE23EF8DFBB0F2D9D452CD5FAD58B74
5BF8A4A50D8BDB29B2F4BF14C44ADD76
</pre>
</pre>


* Location: CprmModule.spu.isoself
Taken from: CprmModule.spu.isoself


==== EID3 seed ====
=== eid4 ===
 
<pre>5FFF3FD81E18B956DAE4E6D3368297EF</pre>
 
* Location: CprmModule.spu.isoself
 
==== EID3 static key ====
 
<pre>D99406CA4BF30750436A454736834589</pre>
 
* Location: CprmModule.spu.isoself
 
=== EID4 ===
 
==== EID4 individuals seed ====


==== eid4 individuals seed ====
<pre>
<pre>
3EC20C17021901978A2971793829D308
3E C2 0C 17 02 19 01 97 8A 29 71 79 38 29 D3 08
0429FA84E33E7F730C1D416EEA25CAFB
04 29 FA 84 E3 3E 7F 73 0C 1D 41 6E EA 25 CA FB
3DE02BC005EA490B03E99198F83F101F
3D E0 2B C0 05 EA 49 0B 03 E9 91 98 F8 3F 10 1F
1BA34B50589428ADD2B3EB3FF4C31A58
1B A3 4B 50 58 94 28 AD D2 B3 EB 3F F4 C3 1A 58
</pre>
</pre>


* Location: sv_iso_spu_module.self
Taken from: sv_iso_spu_module.self
 


== HDD Specific ==
== HDD Specific ==
Used for individual hard drive information.


=== ATA data individuals seed ===  
=== ATA data individuals seed ===  


<pre>
<pre>
D92D65DB057D49E1A66F2274B8BAC508
D9 2D 65 DB 05 7D 49 E1 A6 6F 22 74 B8 BA C5 08
83844ED756CA79516362EA8ADAC60326
83 84 4E D7 56 CA 79 51 63 62 EA 8A DA C6 03 26
</pre>
</pre>


* Location: sb_iso_spu_module.self
Taken from: sb_iso_spu_module.self
 


=== ATA tweak individuals seed ===
=== ATA tweak individuals seed ===


<pre>
<pre>
C3B3B5AACC74CD6A48EFABF44DCDF16E
C3 B3 B5 AA CC 74 CD 6A 48 EF AB F4 4D CD F1 6E
379F55F5777D09FBEEDE07058E94BE08
37 9F 55 F5 77 7D 09 FB EE DE 07 05 8E 94 BE 08
</pre>
</pre>


* Location: sb_iso_spu_module.self
Taken from: sb_iso_spu_module.self


=== ENCDEC data individuals seed ===
=== ENCDEC data individuals seed ===


<pre>
<pre>
E2D05D4071945B01C36D5151E88CB833
E2 D0 5D 40 71 94 5B 01 C3 6D 51 51 E8 8C B8 33
4AAA298081D8C44F185DC660ED575686
4A AA 29 80 81 D8 C4 4F 18 5D C6 60 ED 57 56 86
</pre>
</pre>


=== ENCDEC tweak individuals seed ===
=== ENCDEC tweak individuals seed ===
<pre>
02 08 32 92 C3 05 D5 38 BC 50 E6 99 71 0C 0A 3E
55 F5 1C BA A5 35 A3 80 30 B6 7F 79 C9 05 BD A3
</pre>
== PS2 Emu Specific ==
=== mc_iso individuals seed(?) ===


<pre>
<pre>
02083292C305D538BC50E699710C0A3E
52 38 D0 FA 23 A9 93 B8 97 1D 40 0F 98 2D 21 77
55F51CBAA535A38030B67F79C905BDA3
81 30 DC F4 DE 7C 4E 11 9C 1D E2 86 AA 37 61 0B
1A B7 11 22 3F 27 68 16 59 AE 6B 71 F1 84 F9 CB
0E 00 D0 8A D0 6A F9 F7 A1 D5 5F 69 C7 1D 2B 25
</pre>
</pre>


=== Arcade/SYSDBG Seeds ===
Taken from: mc_iso_spu_module.self


==== ATA data/tweak ====
 
=== me_iso individuals seed(?) ===


<pre>
<pre>
DA73ED9020918F4C0A703DCCF890617B
F2 33 6E 25 63 B6 03 07 7A 76 65 71 26 CA E4 DB
FFD25E3340009109583C643DF4A21324
82 0E 92 85 6B 69 3C E8 14 22 E9 FB 1C 1C A5 B3
E9 43 38 8E 4B 48 03 50 AA 24 A5 FB FA BF D1 72
D9 7A 1E 25 DE 3E 64 A0 A7 A4 82 52 84 56 B1 74
</pre>
</pre>


==== ENCDEC data ====
Taken from: me_iso_spu_module.self
 
== Syscon Specific ==
 
=== sc_iso module seed ===


<pre>
<pre>
D2BCFF742D571A80DFEE5E2496D19C3A
B0 D6 55 76 4C 3B 44 B3 38 F3 2D D1 D0 99 9B 66
6F25FA0FC69764CAC20F4269EB540FD8
48 A3 5A 2C EB 15 E2 8E EC DC 2D C0 B4 C7 EB 05
DC 82 25 C0 D5 78 9D BB 2E 89 A2 4A 78 58 58 00
72 36 38 34 EE 1A 11 6C 2C D2 5E 58 EE 67 63 F7
</pre>
</pre>


==== ENCDEC tweak ====
=== sc_iso key seeds ===
 
<pre>
<pre>
C19C7F987EDB6E244B07BEDEFA1E6CC9
63 DC A7 D3 FE E4 7F 74 9A 40 83 63 F1 10 4E 8F (1)
F08524D98C05654CC742141E01F823E1
4D 10 09 43 24 00 9C C8 E6 B6 9C 70 32 8E 34 C5 [2]
D9 79 49 BA D8 DA 69 D0 E0 1B F3 15 23 73 28 32 (3)
C9 D1 DD 3C E2 7E 35 66 97 E2 6C 12 A7 B3 16 A8 [4]
72 FF 4C 7F D2 A5 90 8D 6C 9C 3F D3 C0 37 FE EB (5)
FA 8D 08 3C 05 20 80 D4 A1 94 53 45 2E 17 9A 44 [6]
35 F8 42 12 95 CB F4 84 E0 6A 17 FA 2F B9 86 86 (7)
C2 F3 68 5E 7E F4 97 68 33 7B 79 FD BC 82 65 BE [8]
C6 E1 93 31 FC 6D 75 D1 C2 80 09 13 D1 79 3C 7E (9)
77 1A 75 5F 40 2D 51 96 D0 2A 0D 09 2B EF E0 1E [10]
B1 17 01 62 9E D2 FA 91 8F 9F 4D 8B 78 D7 2D 74 (11)
19 93 0D E0 B6 FD CF FC 7B A6 30 B8 2D 53 04 31 [12]
44 20 ED 72 2F EA 35 02 19 55 AB 40 C7 8E E6 DF (13)
3E 67 C2 D9 43 2E 15 D0 9B EF 0E 6C 64 92 45 5D [14]
5F A6 AF 2B B0 7F 72 E2 AB F8 0B 4E F6 DA 98 E0 (15)
8C B7 82 E5 3E 8A EB 8A 76 8D 36 65 98 28 1B 9B [16]
</pre>
</pre>


== PS2 Emu Specific ==
Size 256<br>
() first, [] second on ida


Used for ps2 memory card save generation.
<pre>
D4 13 B8 96 63 E1 FE 9F 75 14 3D 3B B4 56 52 74  rev 0x2
FA 72 CE EF 59 B4 D2 98 9F 11 19 13 28 7F 51 C7  rev 0x3
DA A4 B9 F2 BC 70 B2 80 A7 B3 40 FA 0D 04 BA 14  rev 0x4 (1.00 -> 4.00)
29 C1 94 FF EC 1F D1 4D 4A AE 00 6C 32 B3 59 90  rev 0x? (rev 5?, found on 4.30, maybe in below fw's)
</pre>


=== mc_iso individuals seed ===
=== sherwood_ss_seed ===


<pre>
<pre>
5238D0FA23A993B8971D400F982D2177
9F 1D F8 16 BB 4A 4A 01 29 D0 31 CF B0 AD 9B 30
8130DCF4DE7C4E119C1DE286AA37610B
D3 02 FD E1 75 78 FB DB A1 05 84 49 BA 5C 1B EA
1AB711223F27681659AE6B71F184F9CB
0E 6B 74 80 E5 CE B2 56 2A 33 47 BB 41 01 24 55
0E00D08AD06AF9F7A1D55F69C71D2B25
79 10 AC 5D 2A D1 60 01 F6 A2 78 39 79 09 61 03
</pre>
</pre>


* Location: mc_iso_spu_module.self
used for vtrm block crypto (aes_xts)


=== me_iso individuals seed ===
=== ss_seed_one_more ===


<pre>
<pre>
F2336E2563B603077A76657126CAE4DB
E3 05 28 04 B7 D2 83 6F 28 79 A1 75 1B B4 0D 48
820E92856B693CE81422E9FB1C1CA5B3
EF 58 6F 9D 59 91 70 67 68 50 59 0B A6 7D 4B C7
E943388E4B480350AA24A5FBFABFD172
5D 95 98 63 7A F2 5F 80 23 62 3B 12 68 B5 13 1A
D97A1E25DE3E64A0A7A482528456B174
0E AA 32 14 0A 28 61 D8 65 96 26 F6 CE 22 86 DB
</pre>
</pre>


* Location: me_iso_spu_module.self
also used for vtrm block crypto (aes_xts)


== Syscon Specific ==
first block contains crl and drl hashes(see [http://www.psdevwiki.com/ps3/Fixing_DRL_and_CRL_Hashes this] for any doubts you might have)
 
Used for individual SYSCON authentication.


=== sc_iso module seed ===
=== seed_for_backup ===


<pre>
<pre>
B0D655764C3B44B338F32DD1D0999B66
E3 EF DE 98 7E 4A 2D 3F 8C F7 B3 B6 0E 84 6B 21
48A35A2CEB15E28EECDC2DC0B4C7EB05
4A B0 26 66 4E 9D 02 F5 3E FF 95 44 54 9B 1F 97
DC8225C0D5789DBB2E89A24A78585800
7E CA 7F 29 98 91 F1 B2 43 11 9E 35 AE 94 C3 DE
72363834EE1A116C2CD25E58EE6763F7
E0 B7 A0 86 7C F4 49 23 BA E6 5E 33 86 46 0C 80
</pre>
</pre>


=== sc_iso module seed (SD) ===
used to decrypt encrypted root info inside syscon


=== something else ===
<pre>
<pre>
0AB7611E56DA45076B46129718F5C80E
13 16 3A 92 B5 05 13 54 2C 18 AB AD 31 B8 5F B7 <- 1
80BFFBA1800145BF2F1C02F7C011FDE8
2B C8 BB 73 F4 B5 9A C6 58 A7 37 A5 DD 53 5D FE <- 2
E486A45215B5FFFF432DD7F7DFF0C47D
D6 C3 74 FC DF F8 C3 CF 44 01 8C 78 73 3B F5 B2
989ADED904DD987FC93BD735DA114397
64 8B 9F F9 4E F3 21 C6 9A 4A E5 96 F2 F0 8D 22
62 6C 71 24 FC 5B A1 AF 74 36 38 9B A3 7C 66 54
9D 94 BE 46 1C AF 08 3C 9D 9F A1 85 C9 3A EE 7B
 
18 D3 92 2D 4C A4 9C 1F 48 A6 FE FD 24 1D 5C 23 <- n1
05 8E B0 A8 2D 91 99 E8 70 28 C6 7D B9 F4 9A CF <- n2
CC 6A 09 07 DF 49 51 BF 27 CF 7B C2 DE 24 C5 70
F7 6E 53 0B CB CD 38 76 BC EC C8 D5 96 B5 83 B4
12 3D E1 47 FB 53 D5 F4 9D 55 BE 64 0F 2D 7C B0
73 3A A5 52 3A 57 B7 70 F5 97 22 27 0C F2 31 40
</pre>
</pre>
1->n1->2->n2 (in ida)


=== sc_magic::auth_magic ===
http://pastie.org/8710005


<pre>
= Notes =
63DCA7D3FEE47F749A408363F1104E8F auth_1 0x00
4D10094324009CC8E6B69C70328E34C5 auth_2 0x00
D97949BAD8DA69D0E01BF31523732832 auth_1 0x01
C9D1DD3CE27E356697E26C12A7B316A8 auth_2 0x01
72FF4C7FD2A5908D6C9C3FD3C037FEEB auth_1 0x02
FA8D083C052080D4A19453452E179A44 auth_2 0x02
35F8421295CBF484E06A17FA2FB98686 auth_1 0x03
C2F3685E7EF49768337B79FDBC8265BE auth_2 0x03
C6E19331FC6D75D1C2800913D1793C7E auth_1 0x04
771A755F402D5196D02A0D092BEFE01E auth_2 0x04
B11701629ED2FA918F9F4D8B78D72D74 auth_1 0x05
19930DE0B6FDCFFC7BA630B82D530431 auth_2 0x05
4420ED722FEA35021955AB40C78EE6DF auth_1 0x06
3E67C2D9432E15D09BEF0E6C6492455D auth_2 0x06
5FA6AF2BB07F72E2ABF80B4EF6DA98E0 auth_1 0x07
8CB782E53E8AEB8A768D366598281B9B auth_2 0x07
</pre>


* Size: 256 bytes
* libeeid / ps3hdd_poc / ps3_decrypt_tools were adapted for this. so use them
* you'll need eid_root_key, hdd image and eid
* the seeds are spreaded all over the wiki, so it's nice to have a spot where you can look at the seed you wish :)
* many thanks to fail0verfl0w for this. gotta love the print_hash function :3
* https://github.com/zecoxao/ps3_decrypt_tools tools for decrypting and encrypting.
* Regarding syscon, there are two chunks of data, one located at ss_sc_init and the other at sc_iso with sizes 0x290 and 0x280 respectively. one is after keyseed_for_srk2 and the other is between k4 and k5.
* ss_sc_init contains fallback EID1 of size 0x290 bytes.


=== random xseed ===
= References =


[http://pastie.org/2858016 THE PLACEHOLDER] <- this curious pastie contains the first 4 bytes of several keys/seeds
<pre>
<pre>
AB19502586A381E670D34F560EAAF31A20475903
1st-eid2 indiv seed
2nd-eid0 indiv seed
3rd-eid1 indiv seed
4th-eid4 indiv seed
5th-ata data seed
6th-me iso indiv seed
7th-mc iso indiv seed
</pre>
</pre>


Used for generating a random number through the use of ch74.
[http://www.ps3devwiki.com/wiki/Iso_module isolated modules] <- used as reference for eid specific seeds, amongst others


=== data key seed ===
= Others (???) =
[http://pastie.org/private/oxy580s4omh8ofbdfgj3dq  eid4 fallback bytes]


<pre>
<pre>
73686572776F6F645F73735F73656564 "sherwood_ss_seed"
06 78 CE 0E (found, divx player key, decrypt divxdrm.sprx with sc services)
</pre>


=== tweak key seed ===
67 C0 75 8C F4 99 6F EF 7E 88 F9 0C C6 95 9D 66 (found, debug disc fallback)
 
<pre>
73735F736565645F6F6E655F6D6F7265 "ss_seed_one_more"
</pre>
</pre>


=== vtrm key seed ===
Taken respectively from N's Twitter


<pre>
= What's inside: =
6B6579736565645F666F725F73726B32 "keyseed_for_srk2"
</pre>


=== seed for backup ===
== Each EID0 Section (0xC0 bytes) ==


<pre>
{|class="wikitable"
736565645F666F725F6261636B757000 "seed_for_backup."
|-
</pre>
! Description !! Length !! Note
|-
| Data || 0x38 || contains the actual data of the file
|-
| R || 0x14 || part of the ecdsa signature pair (r,s)
|-
| S || 0x14 || part of the ecdsa signature pair (r,s)
|-
| public key || 0x28 || ecdsa public key
|-
| unknown || 0x20 || unknown
|-
| omac/cmac1 || 0x10 || hash of the previous information in CMAC1/OMAC mode
|-
| padding || 0x8 || zero byte padding
|}


== eEID1 fallback ==
[http://pastie.org/6169158 Source of the information]


<pre>
== EID1 (0x2A0 bytes) ==
84DEDB601CBFE24C17DDC7BD1B466406
0126A315C548FDD56C0DF6DE19667079
CB21566A84CAFE5CC883F5255E9586E4
4C02AC7201D69D2F6274E86918BE2703
4A86714B7D122170D45E317F97D173E7
615506000725FDE96EE7ACA391D06F73
3B24EABA2DCB71B6AEC2AB4B809ABD09
B8B7EDD3361CC1F3B71DA99617B7DC01
518E3B27164816ACF9C89157B07BB6C8
633D8DD1CFCE1E15AED07083E38E8EBB
145138B3BA0E240F3A7E77678D9D2961
BD123E045C9C0C58A9A03EB8940A1B99
75A1EE8E575ADFD8811BDE09B098ED38
F87F7DC557618412C827EF32FD5215D0
20900F5D2DF6C1BA52CB1B2E5DBC0310
5C91D011F8F232DD14CFA4E9A3108069
DFA88A3C2E27CB4892E8074794B32CF4
B78EC1E9E6A83ECC280182E29E22EDCE
A0A8BA86FF4304C488A8BD461A9B2D6F
E56C435F841C561E0E724F6CEDF38505
1EBB412CB7BBD395D56FD515782C5957
B687263DF0F4E5353BBAD52CCE4C634F
842663A906ED14319746A91FC63E556A
60426AB2283679450F76054E0EB39F22
F92881B49D9811F846E392FB66056DCB
267AA10094FD262D121B5576A0E6C0F1
58DEF55F710C789D8ED78CDE4E6AD6F8
2D9F8180B8C050D9B1847BC50803D3A4
5CB1178E0241C39AC3AA77558BA96567
7EECBF204F0760ECD976FE20AE97BA5C
4150D9D7EA9AC4C286E63C21FBDCE903
B6AD8EDA663C266A1B8F81F843A1C919
5856F90CB7390EBDB5A000D87F4E2619
CDA436059FD3723C3B6DA657E6D936D8
EA517214BA336B9B57912840AF8A3E76
EA715EE979F03A9857AA358E83B45E0E
8FC797DF9927B0E933EA33EBA1592231
E34C8E3E54C98E27C2E3AB69CC0E45F1
AD1BC8B53D9F87107F3FB7BB1B5E26B2
B710593154505CF21A36E2E57823D5BE
0D5D3AB4CD04B1C27A74BEE02E6D25F4
</pre>


=== eEID1 fallback decrypted ===
This is, quite possibly, one of the most important EID parts in the system. Since the seed was found on syscon selfs, it's very likely that this is directly associated with SYSCON itself.
Unfortunately, there is no way to know because there are additional layers of cryptography inside it.


<pre>
== EID2(0x730 bytes) ==
1E05FC2C1A5C5512E0604252C7A3C942
http://www.psdevwiki.com/ps3/Hypervisor_Reverse_Engineering#Remarrying
9E6C2A490A6543914510071EC93987BB
{|class="wikitable"
3BF1CDB740E234FE7D9A9444FC53E3AB
|-
57548976BA11018074C3FF2ADD1A469A
! Description !! Length !! Note
680EDC509AD0CBC6C90CEA843905482A
|-
BEAB40BA985E134492FD8FC1487DC828
| Header || 0x20 ||
0EEF78B26AD1A241C38C743BB344DAFE
|-
1A0B7E797669107B673A95C4617AF0EC
| Pblock || 0x80 || contains bd drive info
3E600567DC98B61CFB44F5972086CD38
|-
C36D5EC828F2D81476302FED32FC2E83
| Sblock || 0x690 || contains bd drive info
162FA5D83931BFE1154321CDAA240C6C
|}
38B27DF52F81E0069F906075EDB6E739
4EE82A46A9729A68728735DFC9C9F461
A29CD185CC02CF9EB37BDD83D0ABA0AA
BA9D51FBD95F88E3CBDDD2300E51F086
3A059B178EB657C8E793473B0CC3298B
E9AF9924FDD6BCD0E7D3B43161DDF8BF
A8DCAB3577F30F7B81C788B80446B03F
C240BD9F72BBFC7268E4E688C1C24F6E
EF100F2B53199715A99C3E4794487073
74CE56F619FBD2486115A2FBA4F5FBB4
5900A06CB88F39D4D2B430B299EA6910
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
</pre>


* Decrypted with flash key 0x10.
== EID3(0x100) ==
http://www.psdevwiki.com/ps3/Hypervisor_Reverse_Engineering#Communication
{|class="wikitable"
|-
! Offset !! Description !! Length !! Note
|-
| 0x00 || Header || 0x20 ||
|-
| 0x20 || cprm player keys || 0xB8 ||
|-
| 0xD8 || sha1 digest || 0x14 || sha1 digest of previous section
|-
| 0xEC || padding || 0x4 ||
|-
| 0xF0 || omac1 digest || 0x10 || omac1 digest of whole eid3
|}


= Notes =
== EID4(0x30) ==


* There are some tools that to work with these seeds: libeeid / ps3hdd_poc / ps3_decrypt_tools.
{|class="wikitable"
* https://github.com/zecoxao/ps3_decrypt_tools Up-to-date tool for EID decryption and encryption.
|-
* The seeds are scattered all over the wiki, so it's nice to have a spot where you can look at the seed you wish :)
! Description !! Length !! Note
* Many thanks to fail0verfl0w for this. Gotta love the print_hash function :3
|-
| Drive Key 1 || 0x10 || Encrypts data sent from host to bd drive
|-
| Drive Key 2 || 0x10 || Decrypts data sent from bd drive to host
|-
| CMAC/OMAC1 || 0x10 || Hash of the previous bytes in CMAC/OMAC1 mode
|-
|}


* Regarding Syscon, there are two chunks of data, one located at ss_sc_init and the other at sc_iso with sizes 0x290 and 0x280 respectively. one is after keyseed_for_srk2 and the other is between k4 and k5.
== EID5 (0xA00) ==
* ss_sc_init contains fallback EID1 of size 0x290 bytes.


* [https://web.archive.org/web/20141118233711/http://pastie.org/2858016 THE PLACEHOLDER]. This curious pastie contains the first 4 bytes of several keys/seeds:
The largest and quite possibly the most important EID of all 6. It's unknown what is inside this specific EID. We'll probably never know what's inside it without analyzing every possible clue about the PS3. And even then, it might be impossible to find it's real use. It's size is similar to EID0, but it has an aditional 0x1A0 bytes.
<pre>
1st line - EID2 individuals seed
2nd line - EID0 individuals seed
3rd line - EID1 individuals seed
4th line - EID4 individuals seed
5th line - ata data seed
6th line - me iso indiv seed
7th line - mc iso indiv seed
</pre>


= References =
=== Theory ===


[[Iso_module|Isolated modules]] <- used as reference for EID specific seeds, amongst others
{|class="wikitable"
|-
! Description !! Length !! Note
|-
| header(idps) || 0x10 || idps
|-
| unk(static) || 0x2 || 00 12
|-
| unk2(static) || 0x2 || 00 0B (eid0) 00 02(request_idps) 07 30 (eid5)
|-
| perconsole nonce || 0xC ||
|-
| sections || 0x9C0 || 13 sections of 0xC0 bytes each
|-
| footer || 0x20 || footer of eid5 (as bit as important as bootldr/metldr)
|-
|}




{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)