Editing Seeds

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= Source of the PS3 seeds =
== Source of the PS3 seeds ==


The seeds presented on this page were acquired through different means. It started with a simple search (which I have to thank glevand and naehrwert for, as had it not been for those guys, I wouldn't have found myself the confidence to post this) and it went through several people who helped me along the way, and who probably wish to stay anonymous.
The seeds presented on this page were acquired through different means. It started with a simple search (which I have to thank glevand and naehrwert for, as had it not been for those guys, I wouldn't have found myself the confidence to post this) and it went through several people who helped me along the way, and who probably wish to stay anonymous.
= Seeds =


== Common ==
== Common ==
Line 17: Line 15:


* Used on old firmwares, possibly for an old EID0 format (or fallback?) which can be 0x20 or 0x28 bytes in size. Decrypted section is always the same.
* Used on old firmwares, possibly for an old EID0 format (or fallback?) which can be 0x20 or 0x28 bytes in size. Decrypted section is always the same.
* See [https://web.archive.org/web/20141118235214/http://pastie.org/private/rzg83pokd4vnxg60dj3qwg comments].
* See [http://pastie.org/private/rzg83pokd4vnxg60dj3qwg comments].
* Location: isoldr/appldr/lv1ldr
* Location: isoldr/appldr/lv1ldr


Line 23: Line 21:


=== EID0 ===
=== EID0 ===
Used for individual ps3/psp/psn information.


==== EID0 individuals seed ====
==== EID0 individuals seed ====
Line 35: Line 35:
* Location: aim_spu_module.self/isoldr/appldr/lv1ldr/spu_token_processor.self/spu_utoken_processor.self
* Location: aim_spu_module.self/isoldr/appldr/lv1ldr/spu_token_processor.self/spu_utoken_processor.self


==== EID0 section 0 seed for enc/dec + CMAC (Kirk command 0x12) ====
==== EID0 section 0 seed ====


<pre>2ED7CE8D1D55454585BF6A3281CD03AF</pre>
<pre>2ED7CE8D1D55454585BF6A3281CD03AF</pre>
Line 41: Line 41:
* Location: aim_spu_module.self
* Location: aim_spu_module.self


==== EID0 section 6 seed for enc/dec + CMAC (Kirk command 0x12) ====
==== EID0 section 6 seed ====


<pre>3AB0E6C4ACFFB629362FFBBBDBC854BC</pre>
<pre>3AB0E6C4ACFFB629362FFBBBDBC854BC</pre>
Line 47: Line 47:
* Location: pspemudrm (KIRK)
* Location: pspemudrm (KIRK)


==== EID0 section 0xA seed for enc/dec + CMAC (Kirk command 0x12) ====
==== EID0 section 6 for per-console encrypted ECDSA private key ====
 
Notes:
* This seed is the equivalent of the PSP KIRK command 0x10 AES128ECB seed (idskey0).
* Does EID0 section 0xA (or others) use the same seed ? Else why not to search their seed ;) ?


<pre>30B0395DC5835AAA3A7986B44AFAE684</pre>
<pre>33793B9F79E2EBAE55D4D6BF0ED376E6</pre>


* Location: aim_spu_module.self
1) aes-256-ecb encrypt the seed with per-console EID0_key, to obtain the 128bit decryption key to decrypt your encrypted per-console ECDSA private key, located in the decrypted EID0 section 6 at offset 0x88.


==== EID0 section 6 seed for encrypted ECDSA private key (Kirk command 0x10) ====
2) aes-128-ecb decrypt the encrypted ECDSA private key.


<pre>33793B9F79E2EBAE55D4D6BF0ED376E6</pre>
3) Verify the ECDSA private key. See KIRK command 0x10 on PSP wiki.


Notes:
* Location: pspemudrm (KIRK)
* This seed is the equivalent of the PSP Kirk command 0x10 AES128ECB seed (idskey0).
* EID0 sections 7-0xA use a different and unknown seed.


1) aes-256-ecb encrypt the seed with per-console EID0_key (indiv+0x20) and EID0_iv (indiv+0x10), in order to obtain the 128bit decryption key to decrypt per-console encrypted ECDSA private key.
==== EID0 section 0xA seed ====


2) aes-128-cbc decrypt with iv=0 the encrypted ECDSA private key, located at certificate offset 0x88.
<pre>30B0395DC5835AAA3A7986B44AFAE684</pre>


3) Verify the ECDSA private key by using the ECDSA public key at certificate offset 0x10. See KIRK command 0x10 on PSP or PS3 wiki (same constant public key and curve).
* Location: aim_spu_module.self


* Location: pspemudrm (KIRK)
=== eid1 ===


=== EID1 ===
Used for individual SYSCON information.


==== EID1 individuals seed (SD) ====
==== EID1 individuals seed ====


<pre>
<pre>
Line 92: Line 94:


* Location: sc_iso.self/sc_iso_factory.self/ss_sc_init.self
* Location: sc_iso.self/sc_iso_factory.self/ss_sc_init.self


==== Time EID1 seed ====
==== Time EID1 seed ====
Line 105: Line 108:


=== EID2 ===
=== EID2 ===
Used for individual bluray information.


==== EID2 individuals seed ====
==== EID2 individuals seed ====
Line 130: Line 135:


=== EID3 ===
=== EID3 ===
Used for individual CPRM information.


==== EID3 individuals seed ====
==== EID3 individuals seed ====
Line 142: Line 149:
* Location: CprmModule.spu.isoself
* Location: CprmModule.spu.isoself


==== EID3 seed ====
==== EID3 keyseed ====


<pre>5FFF3FD81E18B956DAE4E6D3368297EF</pre>
<pre>5FFF3FD81E18B956DAE4E6D3368297EF</pre>
Line 155: Line 162:


=== EID4 ===
=== EID4 ===
Used for individual bluray auth information.


==== EID4 individuals seed ====
==== EID4 individuals seed ====
Line 264: Line 273:
</pre>
</pre>


=== sc_iso module seed (SD) ===
=== sc_iso module seed {{SD}} ===


<pre>
<pre>
Line 328: Line 337:
</pre>
</pre>


== eEID1 fallback ==
=== eEID1 fallback ===


<pre>
<pre>
Line 374: Line 383:
</pre>
</pre>


=== eEID1 fallback decrypted ===
== eEID1 fallback decrypted ==


<pre>
<pre>
Line 423: Line 432:
= Notes =
= Notes =


* There are some tools that to work with these seeds: libeeid / ps3hdd_poc / ps3_decrypt_tools.
* libeeid / ps3hdd_poc / ps3_decrypt_tools were adapted for this. So use them.
* https://github.com/zecoxao/ps3_decrypt_tools Up-to-date tool for EID decryption and encryption.
* https://github.com/zecoxao/ps3_decrypt_tools Up-to-date tools for decrypting and encrypting.
* You will need eid_root_key (and IV), hdd image and EID.
* The seeds are scattered all over the wiki, so it's nice to have a spot where you can look at the seed you wish :)
* The seeds are scattered all over the wiki, so it's nice to have a spot where you can look at the seed you wish :)
* Many thanks to fail0verfl0w for this. Gotta love the print_hash function :3
* Many thanks to fail0verfl0w for this. Gotta love the print_hash function :3


* Regarding Syscon, there are two chunks of data, one located at ss_sc_init and the other at sc_iso with sizes 0x290 and 0x280 respectively. one is after keyseed_for_srk2 and the other is between k4 and k5.
* Regarding syscon, there are two chunks of data, one located at ss_sc_init and the other at sc_iso with sizes 0x290 and 0x280 respectively. one is after keyseed_for_srk2 and the other is between k4 and k5.
* ss_sc_init contains fallback EID1 of size 0x290 bytes.
* ss_sc_init contains fallback EID1 of size 0x290 bytes.


* [https://web.archive.org/web/20141118233711/http://pastie.org/2858016 THE PLACEHOLDER]. This curious pastie contains the first 4 bytes of several keys/seeds:
= References =
 
[https://web.archive.org/web/20141118233711/http://pastie.org/2858016 THE PLACEHOLDER] <- this curious pastie contains the first 4 bytes of several keys/seeds
 
<pre>
<pre>
1st line - EID2 individuals seed
1st-eid2 indiv seed
2nd line - EID0 individuals seed
2nd-eid0 indiv seed
3rd line - EID1 individuals seed
3rd-eid1 indiv seed
4th line - EID4 individuals seed
4th-eid4 indiv seed
5th line - ata data seed
5th-ata data seed
6th line - me iso indiv seed
6th-me iso indiv seed
7th line - mc iso indiv seed
7th-mc iso indiv seed
</pre>
</pre>


= References =
[Iso_module isolated modules] <- used as reference for EID specific seeds, amongst others
 
[[Iso_module|Isolated modules]] <- used as reference for EID specific seeds, amongst others




{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)