Editing USB Dongle Authenticator

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
 
[[Category:Software]]
== 0x24000 - USB Dongle Authenticator  ==
== 0x24000 - USB Dongle Authenticator  ==
note: inside ss_server1.fself
Dongle check is done on Lv2 kernel start up
File /dev_usb000/pmode_param.txt used by lv2 since fw 3.60


{| class="wikitable FCK__ShowTableBorders"
{| class="wikitable FCK__ShowTableBorders"
Line 26: Line 22:


Here are hexdumps of some challenge bodies i let 0x24001 service generate:  
Here are hexdumps of some challenge bodies i let 0x24001 service generate:  
<pre>2E 02 01 72 3A 0A 76 BB 81 CB 29 BC E7 B5 D6 62 7C 0E EE 23 18 A9 1D</pre>
<pre>2E 02 01 72 3A 0A 76 BB 81 CB 29 BC E7 B5 D6 62 7C 0E EE 23 18 A9 1D
<pre>2E 02 01 F0 DA 78 D4 1D CB D7 C9 C7 F0 32 F4 2E 92 39 BD 3F 32 93 AA</pre>
</pre><pre>2E 02 01 F0 DA 78 D4 1D CB D7 C9 C7 F0 32 F4 2E 92 39 BD 3F 32 93 AA
<pre>2E 02 01 3B B2 9D FD A8 83 AF 9A C0 E9 13 BB AE D5 6C 8C 45 2E DE 13</pre>
</pre><pre>2E 02 01 3B B2 9D FD A8 83 AF 9A C0 E9 13 BB AE D5 6C 8C 45 2E DE 13
 
</pre>
=== 0x24002 - Verify Response  ===
=== 0x24002 - Verify Response  ===


Line 54: Line 50:
*Unfortunately, in the HV dump 3.15 the USB Dongle Master Key was not decrypted at the moment of dumping  
*Unfortunately, in the HV dump 3.15 the USB Dongle Master Key was not decrypted at the moment of dumping  
*The first 12 bytes of decrypted USB Dongle Master Key is a magic value: '''_USB_DONGLE_'''. After these 12 bytes follows the real USB Dongle Master Key of size 20 bytes. So, if after decryption of USB Dongle Master Key, you see this magic value then the decryption was successfull.
*The first 12 bytes of decrypted USB Dongle Master Key is a magic value: '''_USB_DONGLE_'''. After these 12 bytes follows the real USB Dongle Master Key of size 20 bytes. So, if after decryption of USB Dongle Master Key, you see this magic value then the decryption was successfull.
*To decrypt USB Dongle master key you need SC Iso Encrypt/Decrypt 5 Key, seed, Lpar Auth ID (0x1070000001000001), Program Auth ID (0x1070000045000001) and use VTRM Decrypt Master with the Master Key
Here is the encrypted USB Dongle Master Key from HV:
{| class="wikitable"
|-
! 3.15 !! 4.xx
|-
| <pre>22 D5 D1 8C FF E2 4F AC EC 72 A2 42 A7 18 98 10
25 33 E0 96 F2 C1 91 0D 15 23 D3 07 74 E7 2B 72
DF A6 DD E9 68 8B 76 2A 6A 87 51 7F 85 39 0B D4
20 3F 46 89 04 82 B7 30 84 89 4B CC 9D B1 24 7C</pre> || <pre>8E 51 45 76 4B 66 35 2D 69 4A 38 D6 F8 71 CD 1A
25 26 D9 8E 0F 3D 2D D2 1F DC FC CF 1C F7 28 5F
C6 6E C7 03 DB 62 7F 86 AA F6 B9 55 11 D8 64 DD
34 72 C3 59 A0 C4 83 A3 F7 C1 5B 40 32 53 D8 C3</pre>
|-
|}
This is the 16 bytes ''' seed''':
{| class="wikitable"
|-
! 3.15 !! 4.xx
|-
| <pre>5F 55 53 42 5F 44 4F 4E 47 4C 45 5F 41 55 54 48</pre> || <pre>5F 55 53 42 5F 44 4F 4E 47 4C 45 5F 41 55 54 48</pre>
|-
|}


Here is the encrypted USB Dongle Master Key from HV 3.15:
<pre>0x22 0xD5 0xD1 0x8C 0xFF 0xE2 0x4F 0xAC 0xEC 0x72 0xA2 0x42 0xA7 0x18 0x98 0x10
0x25 0x33 0xE0 0x96 0xF2 0xC1 0x91 0x0D 0x15 0x23 0xD3 0x07 0x74 0xE7 0x2B 0x72
0xDF 0xA6 0xDD 0xE9 0x68 0x8B 0x76 0x2A 0x6A 0x87 0x51 0x7F 0x85 0x39 0x0B 0xD4
0x20 0x3F 0x46 0x89 0x04 0x82 0xB7 0x30 0x84 0x89 0x4B 0xCC 0x9D 0xB1 0x24 0x7C
</pre>
This is the '''decrypted''' dongle master key:  
This is the '''decrypted''' dongle master key:  
{| class="wikitable"
<pre>
|-
0x46 0xDC 0xEA 0xD3 0x17 0xFE 0x45 0xD8 0x09 0x23
! 3.15 !! 4.xx
0xEB 0x97 0xE4 0x95 0x64 0x10 0xD4 0xCD 0xB2 0xC2
|-
</pre>
| <pre>46 DC EA D3 17 FE 45 D8 09 23
This is the '''decrypted''' dongle key for dongle ID&nbsp;0xAAAA&nbsp;which works up to 3.55:
EB 97 E4 95 64 10 D4 CD B2 C2</pre> || <pre>46 DC EA D3 17 FE 45 D8 09 23
<pre>
EB 97 E4 95 64 10 D4 CD B2 C2</pre>
0x04 0x4E 0x61 0x1B 0xA6 0xA6 0xE3 0x9A 0x98 0xCF
|-
0x35 0x81 0x2C 0x80 0x68 0xC7 0xFC 0x5F 0x7A 0xE8
|}
</pre>
 
Here is the USB Dongle Master Dummy Key from HV 3.15:
 
<pre>0xD1 0xFC 0x57 0x55 0xBF 0x20 0xFA 0xB2 0xD4 0xA5 0x4A 0x0A 0x0C 0x5D 0x52 0x8E
This is the '''decrypted''' dongle key for dongle ID&nbsp;0xAAAA&nbsp;:
0xDF 0x66 0xCD 0x74
{| class="wikitable"
</pre>
|-
! 3.15-3.55 !! 4.xx
|-
| <pre>04 4E 61 1B A6 A6 E3 9A 98 CF
35 81 2C 80 68 C7 FC 5F 7A E8</pre> || <pre></pre>
|-
|}
 
 
Here is the USB Dongle Master Dummy Key from HV:
 
{| class="wikitable"
|-
! 3.15 !! 4.xx
|-
| <pre>D1 FC 57 55 BF 20 FA B2 D4 A5 4A
0A 0C 5D 52 8E DF 66 CD 74</pre> || <pre></pre>
|-
|}


==== USB Dongle ID Revoke List  ====
==== USB Dongle ID Revoke List  ====
Line 122: Line 78:
*Each bit represents a USB Dongle ID. If bit is 0 then USB Dongle ID is revoked.
*Each bit represents a USB Dongle ID. If bit is 0 then USB Dongle ID is revoked.


The following USB Dongle IDs are revoked in HV:
The following USB Dongle IDs are revoked in HV 3.15:
{| class="wikitable"
<pre>0, 2, 13, 32, 34, 176, 241
|-
</pre>
! 3.15 !! 4.70
|-
| <pre>0, 2, 13, 32, 34, 176, 241</pre> || <pre>0, 2, 13, 32, 34, 176, 241, 286</pre>
|-
|}
 
 
 
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/USB_Dongle_Authenticator"