Bluray disc: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (→‎IRD file: AlexRhine said:)
(→‎Overview: Fix some typos)
 
(One intermediate revision by one other user not shown)
Line 20: Line 20:
* the structure of the UDF filesystem is in not encrypted
* the structure of the UDF filesystem is in not encrypted
* some files are encrypted (their data fall in the encrypted regions of the disc)
* some files are encrypted (their data fall in the encrypted regions of the disc)
* some files are not encrypted (thei fata fall in the non-encrypted regions of the disc)
* some files are not encrypted (their data fall in the non-encrypted regions of the disc)
* as a consequence if the disc is mounted directly, the filesystem file structure is readable and some files are readable but some other files content appears as garbage.
* as a consequence if the disc is mounted directly, the filesystem file structure is readable and some files are readable but some other files content appears as garbage.


Line 285: Line 285:
|9B
|9B
|string
|string
|Game ID
|Title ID
|BCES01584
|BCES01584
|
|
|
| The same value stored in [[PARAM.SFO#TITLE_ID|PARAM.SFO / TITLE_ID]]
|-
|-
|var
|var
|string
|string
|Game name
|Title
|The Last Of Us
|The Last Of Us
|
|
|
| The same value stored in [[PARAM.SFO#TITLE|PARAM.SFO / TITLE]]
|-
|-
|4B
|4B
|string
|string
|Update version
| PS3 system version
|4.41
|4.41
|
|
|
| The same value stored in [[PARAM.SFO#PS3_SYSTEM_VER|PARAM.SFO / PS3_SYSTEM_VER]]
|-
|-
|5B
|5B
|string
|string
|Game version
| Version
|4.41
|4.41
|
|
|
| The same value stored in [[PARAM.SFO#VERSION|PARAM.SFO / VERSION]]
|-
|-
|5B
|5B
|string
|string
|App version
| App version
|01.00
|01.00
|
|
|
| The same value stored in [[PARAM.SFO#APP_VER|PARAM.SFO / APP_VER]]
|-
|-
|4B
|4B

Latest revision as of 00:53, 5 December 2022

Overview[edit | edit source]

Generalities about disc images:

  • disc images are made of sectors
  • a sector is 2048 bytes
  • sector 0 is made of bytes 0 to 2047, etc.

Encryption:

  • some regions of the disc are encrypted, some regions of the disc are not encrypted
  • the encryption is done at the disc (block-device) layer not at the level of the individual file
  • each sector of the encrypted regions is encrypted independently
  • Sector 0 describes which regions of the disc are encrypted (see below).
  • Sector 1 has information about the disc.

File system:

  • UDF filesystem (a profile of ECMA-167)
  • the structure of the UDF filesystem is in not encrypted
  • some files are encrypted (their data fall in the encrypted regions of the disc)
  • some files are not encrypted (their data fall in the non-encrypted regions of the disc)
  • as a consequence if the disc is mounted directly, the filesystem file structure is readable and some files are readable but some other files content appears as garbage.

Disc Info[edit | edit source]

Contained in the second sector.

For example for The Last Of Us: 

00000800: 506c 6179 5374 6174 696f 6e33 0000 0000  PlayStation3....
00000810: 4243 4553 2d30 3135 3834 2020 2020 2020  BCES-01584      
00000820: 2020 2020 2020 2020 2020 2020 2020 2020                  
00000830: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000840: a9c6 f9c8 5e73 7f3b 0442 d0ef 6e95 4caf  ....^s.;.B..n.L.
00000850: 01df f413 6077 f26b b853 1fd2 ca12 5732  ....`w.k.S....W2
00000860: f982 affb 281a 1286 afbd 3faf 50ff 71c6  ....(.....?.P.q.
00000870: a386 d213 7ebe 40b0 3b83 244d 1dd1 4587  ....~.@.;.$M..E.
00000880: f276 704e cb4f fd02 010c c825 35c5 ac89  .vpN.O.....%5...
00000890: a146 df4b 23ca 4281 451f 3cbb c1d3 b734  .F.K#.B.E.<....4
000008a0: ed6a beeb e38f 62e8 60b2 5384 b81e 1fe2  .j....b.`.S.....
000008b0: 0262 2399 4197 c731 1e7d 72fc 1122 4438  .b#.A..1.}r.."D8
000008c0: f2be 70fa eae9 b707 5325 0cd4 2f65 dc2d  ..p.....S%../e.-
000008d0: e55a b8da 27f5 2e01 e6d9 6a25 294a 6243  .Z..'.....j%)JbC
000008e0: 22bf a306 e597 b985 4899 35eb d088 97e1  ".......H.5.....
000008f0: f252 3dec ef07 336c 54b3 c70e 4026 6771  .R=...3lT...@&gq
00000900: a87b 901f 0f91 f216 36ef 4a6d 4576 c51d  .{......6.JmEv..
00000910: e23b 274b 3001 d63c 67e2 4896 20d6 d0f7  .;'K0..<g.H. ...
00000920: fb37 11db 185d 1e1e 8bcc 527d 8591 86ca  .7...]....R}....
00000930: 0ebf 0f05 38c9 ce33 108a 246f fd49 6b5a  ....8..3..$o.IkZ
00000940: c232 e26d d9df f0c1 7a87 bdf6 7a38 9199  .2.m....z...z8..
00000950: 5e7b ffc9 c676 2776 767f d196 584e ee9f  ^{...v'vv...XN..
00000960: 6b45 265e 4f5a a1b2 f96a 6b3a b62b e35d  kE&^OZ...jk:.+.]
00000970: ca9c 263a eb10 797b 90ce 1d43 0d5f 7ead  ..&:..y{...C._~.
00000980: 2717 a0cb 3cf8 943d 5af4 c346 734f 4fe1  '...<..=Z..FsOO.
00000990: 93cd 4408 a836 ffac a114 52f3 ae7d 8b07  ..D..6....R..}..
000009a0: dd9b 16b0 8f76 f8d7 d881 3c60 2923 6bca  .....v....<`)#k.
000009b0: 9405 f135 4439 288e c634 89ad 58cf 4bfd  ...5D9(..4..X.K.
000009c0: 4e9e 9f37 fb70 2fb7 ed1c a802 79b9 1479  N..7.p/.....y..y
000009d0: 12e8 0f0c 424c 1d4b 218d 0d72 9021 3346  ....BL.K!..r.!3F
000009e0: ba47 9953 fe42 c35d d4cf c182 4991 26fd  .G.S.B.]....I.&.
000009f0: 0962 1abb 48cd f6c3 3c11 fd3a bfca c75f  .b..H...<..:..._
00000a00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
...
  • The first 16 bytes identify a PS3 disc.
  • The next 32 bytes are the disc ID (with space padding)
  • 0x840: ?

Encryption[edit | edit source]

The first sector of the disc tells which parts of the disc are unencrypted and which one are encoded.

For example, this is the beginning of "The Last of Us" disc: 

00000000: 0000 0003 0000 0000 0000 0000 0000 099f  ................
00000010: 00a2 6160 00ba 73ff 011d dda0 011f ddbf  ..a`..s.........
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
  • 0x00000003: number of unencrypted regions
  • Sectors 0x00000000 to 0x0000099f: first unencrypted region
  • Sectors 0x0000099f to 0x00a26160The: first encrypted region
  • Sectors 0x00a26160 to 0x00ba73ff: second unencrypted region
  • Sectors 0x00ba73ff to 0x011ddda0: second encrypted region
  • Sectors 0x011ddda0 to 0x011fddbf: third unencrypted region

Note:

  • 0x011fddbf sectors is 38636746752 bytes whereas the file is 38636748800 bytes;
  • the last sector is not included for some reason.

Deriving the disc key[edit | edit source]

The disc key is obtained by encrypting "data1" with AES CBC:

  • with the secret 0x380bcf0b53455b3c7817ab4fa3ba90ed
  • with the IV 0x69474772af6fdab342743aefaa186287
  • no padding

Where can I get data1?

  • it can be found on the disc with a bunch of SCSI commands (assuming you have a suitable BD drive)
  • for the rest of us, it is available in the IRD file

Sector encryption[edit | edit source]

Each disc sector is encrypted (independently from the other sectors) with AES CBC:

  • using the disc key
  • no padding

The IV is derived from the sector number with: 

int num = sectorNumber;
byte[] iv = new byte[16];
for (int j = 0; j < 16; j++)
{
	iv[16 - j - 1] = (byte)(num & 0xFF);
	num >>= 8;
}

File system layout[edit | edit source]

  • PS3_DISC.SFB
  • PS3_GAME/ICON0.PNG
  • PS3_GAME/LICDIR/LIC.DAT
  • PS3_GAME/PARAM.SFO
  • PS3_GAME/PIC1.PNG
  • PS3_GAME/PS3LOGO.DAT
  • PS3_GAME/SND0.AT3
  • PS3_GAME/TROPDIR/
  • PS3_GAME/USRDIR/build/
  • PS3_GAME/USRDIR/data/
  • PS3_GAME/USRDIR/EBOOT.BIN
  • PS3_UPDATE/PS3UPDAT.PUP
PS3 Disc Game Structure
[edit]
Disc Path XMB
icon		 SFB/SFO/SFX Mandatory Parameters Since Enabled by
APP_VER ATTRIBUTE BOOTABLE CATEGORY TITLE TITLE_ID
dev_bdvd/ PS3_DISC.SFB Yes 1.00 Enables others with HYBRID_FLAG
PS3_GAME/ PARAM.SFO PS3 Blu-ray Disc Opt Opt Opt Game DG Yes Yes 1.00 HYBRID_FLAG (g) in PS3_DISC.FSB
USRDIR/ EBOOT.BIN 1.00 BOOTABLE (1) in parent PARAM.SFO
INSDIR/ PARAM.SFO No? Yes No No Game AR No No ? HYBRID_FLAG (g) in PS3_DISC.FSB ?
DATA000.PKG (up to 999) ?
PKGDIR/ PARAM.SFO PS3 Blu-ray Disc (installable contents) No Yes No Game DP Yes Yes 1.00 ? ATTRIBUTE (131072) in parent PARAM.SFO
PKG01/
(up to 99)		 PARAM.SFO Preinstall Package No No No Game IP Yes Yes 1.00 ? ATTRIBUTE (1) in parent PARAM.SFO
INSTALL.PKG 1.00 ?
LICDIR/ LIC.DAT 1.00
TROPDIR/ <NPCOMMID>/ TROPHY.TRP 2.40
PS3_GM01/
(up to 99?)		 PARAM.SFO PS3 Blu-ray Disc Opt Opt Opt Game DG Yes Yes 4.00+ ? HYBRID_FLAG (g) in PS3_DISC.FSB
USRDIR/ EBOOT.BIN 4.00+ ? BOOTABLE (1) in parent PARAM.SFO
LICDIR/ LIC.DAT 4.00+ ? dev_bdvd/PS3_GAME/LICDIR/LIC.DAT
PS3_CONTENT/ THEMEDIR/ PARAM.SFO PS3 Blu-ray Disc (installable contents) No Yes No Game TR Yes No ? 2.00+ HYBRID_FLAG (T) in PS3_DISC.FSB
D001/ DATA001.P3T
(up to 999)		 Preinstall Package 2.00+ ATTRIBUTE (1) in parent PARAM.SFO
VIDEODIR/ PARAM.SFO PS3 Blu-ray Disc (video contents) No Yes No Video VR Yes No ? ? HYBRID_FLAG (V) in PS3_DISC.FSB
D001/
(up to 999)		 PARAM.SFO ? No No No Video VI Yes No ? ATTRIBUTE (1) in parent PARAM.SFO
DATA000.MP4 ?
PS3_EXTRA/ PARAM.SFO PS3 Blu-ray Disc No Yes No Game XR Yes Yes 3.41- HYBRID_FLAG (g) in PS3_DISC.FSB ?
D001/
(up to 999)		 PARAM.SFX Package Content No No No Game IP Yes No 3.41- ATTRIBUTE (1) in parent PARAM.SFO
DATA000.PKG 3.41-
D002/
(up to 999)		 PARAM.SFX Theme Content No No No Game TI Yes No 3.41- ATTRIBUTE (1) in parent PARAM.SFO
DATA000.P3T 3.41-
D003/
(up to 999)		 PARAM.SFX Video Content No No No Game VI Yes No 3.41- ATTRIBUTE (1) in parent PARAM.SFO
DATA000.MP4 3.41-
PS3_VPRM/ PARAM.SFO PS3 Blu-ray Disc (video contents) No No No Video DM No No ? HYBRID_FLAG (v) in PS3_DISC.FSB
PS3_UPDATE/ PS3UPDAT.PUP 1.00 ? HYBRID_FLAG (u) in PS3_DISC.FSB

See also Content Information Files

Extra "tracks"[edit | edit source]

Blu-ray Disc Information[edit | edit source]

See http://www.t10.org/ftp/t10/document.04/04-328r0.pdf#page=43:

A DI unit is 112 bytes in PIC on a BD-RE disc. The DI unit that contains physical information shall

be returned. The information for layer 0 shall be returned when the Layer field of the CDB is set to zero. The information for layer 1 shall be returned when the Layer field of the CDB is set to 1. See System Description Blu-ray Disc Rewritable Format, Part 1 Basic Format Specifications for

DI unit detailed definition.

AFAIU, the description of its content is in a spec under NDA.

Exemple from "The Last Of Us": 

00000000: 1002 0000 4449 0110 0000 2000 4244 4f01  ....DI.... .BDO.
00000010: 2101 0300 0000 0000 019a f5bf 0010 0000  !...............
00000020: 00ca 73fe 0000 0000 0000 0000 0000 0000  ..s.............
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 4449 0111 0001 2000 4244 4f01  ....DI.... .BDO.
00000050: 2101 0300 0000 0000 019a f5bf 0135 8c00  !............5..
00000060: 01ef fffe 0000 0000 0000 0000 0000 0000  ................

It can be read with the READ DISC STRUCTURE SCSI command.

Reading it (in C on Linux): 

#define PIC_SIZE 112

  unsigned char read_pic_command[12] = {
    173, // Operation Code=READ_DISC_STRUCTURE
    1,   // Reserved=0, MediaType=1 (BD)
    0,
    0,
    0,
    0,
    0,
    0, // FormatCode=0 (Disc Information)
    pic_size / 256,
    pic_size % 256,
    0,
    0
  };

  int drive = open(drive_filename, 0, O_RDONLY);
  if (drive == -1) {
    fputs("Can't open file\n", stderr);
    return 1;
  }

  unsigned char sense_data[12];

  // Actually there is a lot more than that:
  unsigned char* pic = malloc(pic_size);
  memset(pic, 0, pic_size);

  struct sg_io_hdr header;
  memset(&header, 0, sizeof(header));
  header.interface_id = 'S'; // SCSI
  header.dxfer_direction = SG_DXFER_FROM_DEV;
  header.cmd_len = sizeof(read_pic_command);
  header.mx_sb_len = sizeof(sense_data);
  header.iovec_count = 0;
  header.dxfer_len = pic_size;
  header.dxferp = pic;
  header.cmdp = (unsigned char*) read_pic_command;
  header.sbp = sense_data;
  header.timeout = 60 * 1000;
  header.flags = 0;
  header.pack_id = 0;
  header.usr_ptr = NULL;
  header.status = 0;
  header.msg_status = 0;
  header.sb_len_wr = 0;
  header.host_status = 0;
  header.driver_status = 0;
  header.resid = 0;
  header.duration = 0;
  header.info = 0;

  if (ioctl(drive, SG_IO, &header) < 0) {
    fputs("ioctl failed\n", stderr);
    return 1;
  }

  if ((header.info & SG_INFO_OK_MASK) != SG_INFO_OK) {
    fputs("SCSI failed\n", stderr);
    return 1;
  }

"Data1" and "Data2"[edit | edit source]

Read after authentication with some undocumented SCSI commands. Not sure if those are PS3-specific SCSI commands.

IRD file[edit | edit source]

3k3y generates IRD files which contains some information about the disc. In particular, it contains "data1" which is used to derive the disc AES encryption key. It contains the PIC zone as well (which is outside of the normal area of the disc and thus not present in ISOs) but it's not clear how useful that is.

The file is:

  • either uncompressed (magic string "3IRD");
  • or gzipped (gzip magic string 0x1f8b) with a (4 bytes) CRC afterwards.

The format is based on .NET BinaryReader/BinaryWriter:

The format is (v6 to v9):

Size Format Description Example Versions Notes
4B string Magic string ("3IRD") 3IRD
1B uint Version 6, 7, 8, 9
9B string Title ID BCES01584 The same value stored in PARAM.SFO / TITLE_ID
var string Title The Last Of Us The same value stored in PARAM.SFO / TITLE
4B string PS3 system version 4.41 The same value stored in PARAM.SFO / PS3_SYSTEM_VER
5B string Version 4.41 The same value stored in PARAM.SFO / VERSION
5B string App version 01.00 The same value stored in PARAM.SFO / APP_VER
4B uint ID v=7
var compressed Header
var compressed Footer
1B uint Region count
16B bytes Region 1 hash
… … … … …
4B uint File count
8B uint File 1 key The offset/sector of the file's whose hash is shown
16B bytes File 1 hash
… … … … …
4B bytes Padding (00 00 00 00)
115B bytes PIC v=9
16B bytes Data 1
16B bytes Data 2
115B bytes PIC v<9
4B uint/bytes UID
4B uint CRC

Compressed data are compressed with gzip and prefixed with a length (uint32).

References[edit | edit source]

  • 3k3y IsoTools, this is a .NET program available in binary form. The ILspy decompiler produces a very readable output.
  • PS3 ISO Patcher by BlackDaemon, is a .NET program available in source code
  • See also ODE page
General
Hypervisor
Services
Plugin
Interfaces
ap_plugin · audioplayer_plugin · audiop_plugin_dummy · audiop_plugin_mini · auth_plugin · autodownload_plugin · autoupdateconf_plugin · avc_plugin · avc_util · avc2_game_plugin · avc2_game_video_plugin · avc2_text_plugin · bdp_disccheck_plugin · bdp_plugin · bdp_storage_plugin · campaign_plugin · category_setting_plugin · comboplay_plugin · custom_render_plugin · data_copy_plugin · deviceconf_plugin · dlna_plugin · download_plugin · dtcpip_util · edy_plugin · esehttp · eseibrd · eseidle · eselock · eula_cddb_plugin · eula_hcopy_plugin · eula_net_plugin · explore_plugin · explore_plugin_ft · explore_plugin_game · explore_plugin_np · filecopy_plugin · friendim_plugin · friendml_plugin · friendtrophy_plugin · game_ext_plugin · game_indicator_plugin · game_plugin · gamedata_plugin · gamelib_plugin · gameupdate_plugin · hknw_plugin · idle_plugin · impose_plugin · kensaku_plugin · msgdialog_plugin · mtpinitiator_plugin · musicbrowser_plugin · nas_plugin · netconf_plugin · newstore_plugin · np_eula_plugin · np_matching_plugin · np_multisignin_plugin · np_sns_plugin · npsignin_plugin · np_trophy_ingame · np_trophy_plugin · osk · oskfullkeypanel · oskpanel · pesm_plugin · photo_network_sharing_plugin · photolist_plugin · photoviewer_plugin · playlist_plugin · poweroff_plugin · premo_plugin · premo_game_plugin · print_plugin · profile_plugin · ps3_savedata_plugin · ps3_savedata_plugin_game · ps3_savedata_plugin_psp · rec_plugin · regcam_plugin · remotedownload_plugin · sacd_plugin · scenefolder_plugin · screenshot_plugin · software_update_plugin · soundvisualizer_plugin · strviewer_plugin · sysconf_plugin · system_plugin · thumthum_plugin · upload_util · user_info_plugin · user_plugin · videodownloader_plugin · videoeditor_plugin · videoplayer_util · videoplayer_plugin · vmc_savedata_plugin · wboard_plugin · webbrowser_plugin · webbrowser_service · webrender_plugin · xai_plugin · xmb_ingame · xmb_plugin
Emulation
Extended
features
Online
Hardware
SC
CELL
RAM
SB
HDD
BD
Tools
Strings
files
dumps
Reference
Keys & Seeds
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Bluray_disc&oldid=68885"