Keys
Keys Notes
You can download the keys from: ps3keys (or for scetool here : scetool/data/)
Location
keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys
Naming
naming:
- file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np
- (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)
- file suffix: .092 .315 .341 .350 .355 .356
- (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)
- key file (erk): %s-key-%s
- iv file (riv): %s-iv-%s
- ctype file (curvetype): %s-ctype-%s
- pub file (public): %s-pub-%s
- priv file (private): %s-priv-%s
Key Table Structure
generic in loaders
Keys are kept in tables and indexed by the sdk_type in the SELF header.
struct key_obj { uint8_t key[0x20]; uint8_t iv[0x10]; uint8_t pub[0x28]; uint32_t curve_type; uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines }
appldr specific
typedef struct _appldr_key_container { /* start-end (length) */ u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */ u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */ u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */ u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */ u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */ /* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */ } appldrKeyContainer; appldrKeyContainer rev0x00_0x0c_1[13]; appldrKeyContainer rev0x00_0x0c_2[13]; appldrKeyContainer unknown; appldrKeyContainer npdrm_1[13]; appldrKeyContainer npdrm_2[13]; appldrKeyContainer revoke;
Curves Notes
- first "curve" (type 00) is probably reserved (and cannot be used because it's an invalid curve that serves no purpose since it's fully zeroed)
- second curve is ONLY used in kirk CMD 1 parameters (which means that some of the keys/curves from psp were ported to ps3)
- third curve is the most widely used curve and serves the general use purpose
Key Scrambling
Starting with firmware version 3.60 loader keys have been encrypted. Look here for a tool that decrypts them. Besides that, there is an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side.
Root scramble keys
type | version | key |
---|---|---|
root | 3.60-3.61 | 844F80F3C57C455C7F09
|
root | 3.65-3.66 | 865128F745845947A0CE
|
root | 3.7x | 0DAD161222CDDB00A631
|
root | 4.00-4.1x | D029857926C7A918D48E
|
root | 4.20-4.80 | F5FD0DFD54B738FC8895
|
Scramble keys
type | version | key1 | iv1 | key2 | iv2 |
---|---|---|---|---|---|
isoldr | 3.60 | 5389A6DFA8567D43A80DA6DAB90EE946 |
A51A2C7960AC1BE43AA0FB7695094188 |
212E7E92FF1FB75AE5C1323037C34693 |
90AF09A666BB0C663BF2FC8E5338B7B8
|
isoldr | 3.65 | E37A763FD7A559CFD7E1E2DA5C8CBAC4 |
198361A904E748381CB9AA1DF5CCAB17 |
23EAD00FC78D9A8B7785EB600124238C |
61B0D045DF5727EFC19E5BE53BE70F14
|
isoldr | 3.70 | 9FD83EA32E9EAA0EF54AD0CFBB60D1DF |
194B649CDA9F4D814CD119C603E49FB5 |
A9709BE3E8043BA24635A2617541E9D5 |
F06A5B2FEF9CA87B1759DC53AEE1A3B5
|
isoldr | 4.11 | FFD6342FC86B81F0E56C6867D618D72A |
A51A2C7960AC1BE43AA0FB7695094188 |
194922A1EEB01E614884A44D1D7B7FC1 |
90AF09A666BB0C663BF2FC8E5338B7B8
|
isoldr | 4.21 | 4DEA657828657CA86AB93E2162592B97 |
EEB72FC7E42544C460E78EA30C72D211 |
CE2D1A7AA4F4434058F0C8A64400CBF5 |
852CC5C6C5D3B7EEB1801147B32E8D21
|
lv1ldr | 3.60 | F92C8666EFFBAC7EB583E54A257F7C05 |
F2E70BC4BAC10C3D8DDBB7DC23053F9A |
DDF6A5B143C1141FEED01CDA719705C3 |
018E695C3A29AF6E746A73CBF73DBDFD
|
lv1ldr | 3.65 | 546DE455AB15F33546D2296C2535FA44 |
ACA9C00DA6D778A95EBD9D76E659C14F |
AB82EF1F62CC382CF2880A870499AE89 |
6ECB2AC4DA8D400F0167F1EB9FD8D7F1
|
lv1ldr | 3.70 | F98E56F3CB0D68797E3D81F0BE36CFBD |
7DA5A5487AFA3032BF49D40CEBEC2480 |
7EAFED452D621269CB7EF46D7BE3DAD9 |
A5C6E2A25C2DD09D6597F69EEB3A2CE5
|
lv1ldr | 4.11 | 80863EDBAE50DD4B16125FC9321BBC24 |
1A9E31FEBD603A9CBE4ECD6026292466 |
D4E2AA7293192CB1600D537A9E832F2D |
4503E4E505A773C55E0B8E1332341287
|
lv1ldr | 4.21 | AC19D5DB427351434DC6DA3BD6E3DE6C |
66E68237D5B7228AA2F057B6043768E1 |
466CD2F735628B8EF99D1793063BBB3B |
761907BA41A7945028D8FD8305B25BD2
|
lv2ldr | 3.60 | A25E7F097B2FC7B1082032C4387DB335 |
0655809B26DF5F29E4E740D950A8CB53 |
6B97507247CD680FE56D9E19D06DFC71 |
B72B9DBB5C2CC74EB75C7B9815DBD5D8
|
lv2ldr | 3.65 | 4B973A45A23894CBF0CDFC168B7EFB31 |
2210B3103E7EDFD8CE0B25551B1D4003 |
858CFE093654E3EFA16FCCE5F73C9591 |
481472B4DF63EA5F883DAA2872EE5D2F
|
lv2ldr | 3.70 | 85AEC67CB85BD04D3E7D3D76AA604FF5 |
51B40C084A81C9BE35108FFC0C008F64 |
616004C6C2D614737106FE41668826A7 |
A765A845AAB477EABFEF4274ADA6AF04
|
lv2ldr | 4.11 | 020397E6D292288F80659F06E2DACEFB |
4CC9A8A9EED889070F066EC9A7CADA2B |
577BA1CBF1FD40A3EF53C9B5DAC3AC60 |
B64BF3D04FBB3F8D29F9E63A97DF3DA9
|
lv2ldr | 4.21 | 872D02292EE7ED3544AFF20EEA5E6F0C |
2E0CBBD250150410302F7E8B33039EF3 |
A02BA1F74446E4BAE04AF5CF13D94154 |
2009879EED2F443367C80B62F9D1748F
|
appldr | 3.60 | EE409F8CD0B7F8AF17769D5F6D67EA3F |
6BF7B2D5B0ED87EF4CF601D53EEA111A |
2149690206DD0ABC0CD5367C4AF2C810 |
39D8E32CF3F1558902247F733D5284BF
|
appldr | 3.65 | D1FF8A1B7AD27A186B0F1E2FFF5C2B65 |
4D5EC61604BCE8250E62600376061878 |
8F40C9F3CEF5284F5F432BD906ECDF24 |
0B107F57C095B31EF15B95FFEC5134B2
|
appldr | 3.70 | 2AF91823CE38598E8D66245F698AB572 |
D1A74E3DED98145F023F07FFB60D2B1D |
04BE8DD318D3E7454A166296B022F88D |
16D3B1E7B007FDFE101C029B5F39C761
|
appldr | 4.11 | 6BFAFA124D4B88841BCB861364C32826 |
3F7679B0A1430C490C1F249EAA468D2C |
4338700B5FA64276DD3E57806ED679FD |
CFCAE1AF6F98E5651CBB021D78DD8F1B
|
appldr | 4.21 | AAF65A91EC372C690969090F59E53C3E |
A5798C254313BC5416951E24EAD3C985 |
66BCB417D14A2B592640801C11B7B49B |
2FF236152A4776DAD39B509244E8F5C2
|
Scrambled keysets
Type | Version | ERK | RIV |
---|---|---|---|
rvk_prg | 3.60 | FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4 |
E06DC9567BE0EA09D5D1A5355B996FC6
|
rvk_prg | 4.21 | 1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8 |
30B9F738238A015014A44DD57B3A1661
|
isoldr | 3.60 | 7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1 |
B3E9683977AE89DE9AFFE6330774505C
|
isoldr | 3.65 | 1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0 |
2E691E3343A55B99E8A935B0443BD67B
|
isoldr | 3.70 | 7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7 |
E46F02FDCA9F40CC5CD715D930190FE0
|
isoldr | 4.11 | B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83 |
2912F5FC4C4FF400940B369193303D16
|
isoldr | 4.21 | A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D |
36762D06A6F6FBFFE342D8853A3CD440
|
lv1ldr | 3.60 | 18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812 |
9B32B20FA77280F1095EA13F1C2D5C99
|
lv1ldr | 4.21 | 189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3 |
E372B32F7E439D30AC6CEC68CA23D903
|
lv2ldr | 3.60 | 451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F |
E8831E56EF9FA4D8D4BF7A6E78025644
|
lv2ldr | 3.65 | 2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739 |
FD9D731564C1D1F0A4258667100D1F17
|
lv2ldr | 3.70 | 7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4 |
90A06C54C727844AB5300BB6AB54C537
|
lv2ldr | 4.11 | ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794 |
CF33BDA9F55C71BD9F38B31162FCB0E3
|
lv2ldr | 4.21 | B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328 |
2D4C6F9F0AAF26A728CA166D03449321
|
edat-key-0 | 4.21 | 270C4A349DE7A329BB04FD8642C43591 |
|
edat-hash-0 | 4.21 | 25790BA9D671FB125E53F013B0F9862E |
|
edat-key-1 | 4.21 | D1DF87B5C1471B360ACE21315A339C06 |
|
edat-hash-1 | 4.21 | 6D4BF3D7245DB294B6C3F9E32AA57E79 |
Key lists
sc_iso module 060.013.r010 - 4.75
0: 1: 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75) 2: 73636B65795F7365726965736B657900 (INTERNAL) 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75) 3: 73636B65795F7365726965736B657932 (INTERNAL) 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56) 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75) 4: 73636B65795F666F725F6D6173746572 (INTERNAL) 5:
see also: http://pastie.org/3130817 / http://pastie.org/10206783
sb_iso_spu_module 083.006.r010 / 1.02
0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 <- sb_iso_magic_px 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E <- sb_iso_fix2_px 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 <- sb_iso_fix1_px 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 <- sb_iso_magic_dx 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF <- sb_iso_fix2_dx 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 <- sb_iso_fix1_dx
sb_iso_spu_module 3.41
6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27 A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121 B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609
note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)
sv_iso_spu_module 095.001 - 3.55
key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv iv_0(giv): 2226928D44032F436AFD267E748B2393 key_0_0(kms1): 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0 key_0_1(kms2): D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1 key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0 iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1 key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?) iv_2(IVh): 69474772AF6FDAB342743AEFAA186287 debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?) ivs_3des: E80B3F0CD6566DD0 eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9 eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3
eid4_fallback keys added from this source
trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj
spu_token_processor
095.001 - 3.56: token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED token-iv: E8663A69CD1A5C454A761E728C7C254E 3.60-Template:Latest: token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404 token-curve-type: 0x9
08x - ??? SD
token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B
token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA
token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3
spu_utoken_processor 3.55
utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736 utoken-iv: A6523E5426470953FE8C90F61BCA927A
sc_iso
secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - Template:Latest secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - Template:Latest secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70 sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7 sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2 sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22 sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654 sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B sc_key::key_for_master : 73636B65795F666F725F6D6173746572 sc_key::series_key : 73636B65795F7365726965736B657900 sc_key::series_key2 : 73636B65795F7365726965736B657932
gpkg-key
ps3_gpkg_key: 2E7B71D7C9C9A14EA3221F188828B8F8
- Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x361F6@elf file.
psp_gpkg_key: 07F2C68290B50D2C33818D709B60E62B
- Location: nas_plugin.sprx , from fw3.55cex: sub_36EEC, offset: 0x3724A@elf file.
service mode dongle HMAC
46DCEAD317FE45D80923EB97E4956410D4CDB2C2
PUP HMAC
F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366
DAT
dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF dat-key: 2B7E151628AED2A6ABF7158809CF4F3C
EDAT
edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081 edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011 edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747
SDAT
sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (sdat-sha1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)
PS3 Minis
ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570) ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)
Note: for minis iso.bin.edat
aim keys
aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 <- idps_magic10 aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF <- idps_magic aim_iv : 51F78B72A64711CF5C72323FB8607A00 <- magic_iv0 aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 <- magic_key0 aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)
http://pastie.org/2547291
(ks version depends on the first four bytes of the eid)
aim_compare->magic_0(note that there's magic_1 and magic_2 also on really old firmwares)
mode_auth_data
key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF iv : 0123456789ABCDEFFEDCBA9876543210 hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037 F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872 magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)
(Product Mode authentication data)
SYSCON_MANAGER_KEY
D413B89663E1FE9F75143D3BB4565274
sc_iso_module_1.00-4.00
source
AACS key/iv
aes-256-ctr_key:
995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96
aes-256-ctr iv:
802794556C7716719B40A175DB9A455E
[Another decrypted arrays with this key]
magic: FolkloreJam
key:
2DC2DF39420321D0CEF1FE2374029D95
iv:
0BA0F8DDFEA61FB3D8DF9F566A050F78
new magic: CODEFACE
public key 1 enc:
453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2
public key 1 dec:
63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27
public key 2 enc:
5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122
public key 2 dec:
784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7
public key 3 enc:
26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5
public key 3 dec:
00000000000000000000000000000000000000000000000000000000000000000000000000000000
Curve:
p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8 N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017 Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6 Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9
Second aes-256-ctr_key:
6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384
Second aes-256-ctr iv:
BC0D7738D332B780A6F89ED022745F0A
CPRM
Decryption key for obfuscated arrays:
Key 688D8FECC3AAB50AAE45506B41A48BC3 IV 6AC5B2F7055C031AE36BA31D285D24E5
Decrypted array 1:
3AD09AB6F5C116B758F6EDE6D98C57FC FD4B9B470E8EFFF3BBBA0A8015D72B36 6A435A89B45D71198FA088B8E88AC3AE 7C4E3DB596CC21001A6B12DB1FE4119D D39368B07F3B52B994DDA51B466031EC C9F8E95E1398BF27560891E36F2040B2 2CCE0210E018D56CDECD8779AFA92650 F233926EC03F3941AA5B7D2403D62FEB 0B99864C51458D2EEF077BE24D7AFE25 5C29A2A8B1F0B3C4307E6338CBF44FD1 DF4432DC175F662A819E774A656734FA 541E14BE04F1A79C8B37EE85AB220F69 C5D40584A47342A164E1708390C2480D 611CC672FB7674E701D8C8D275A3CF28 821D4935C7BDCAA6AC0C62ADF93CEA2D 59DA3E976D09F755E523539F06BC9578
Decrypted array 2:
009153EE3EC7524B0000000000000000
AV CC Multi
942C152C1C2C9D2C94AE15AE1CAE9DAE
Archive keys
FA72CEEF59B4D2989F111913287F51C7 generic key
EA02CEEF5BB4D2998F611910D77F51C6 per console key
Marlin DRM
DES key/iv? 7563686979616D61
KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443
DivX DRM
Key 0678CE0EC45DA9554D2CDA549B91BC1C
Arcade Master Key
Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F IV 929214D8FCCB4CE7099ACEBDFC6612B9
- used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds
- located at Lv1Ldr
Arcade ATA Decryption Key
Key 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A IV 00000000000000000000000000000000
- algo is aes-192-cbc, used for System 357A (GECR-1100)
- Key forged by encrypting Arcade ATA Seeds with Master Key
Lv2_Kernel Unknown Keys
keyset1_key1 1F90E2032162E7E53766C5047B119807 147AFB579BB705F2AA3DAE35EB22D36B 9C4B52410EA3EDFB1520D43A757B89F9 C3773873153DBDA5AD8E62E6AD0AE091 keyset1_key2 4387280F4A69A923ACE904AD5E1A325F 68F03A8F3883E75E72D018534AB915BF 85328C09A915BE182CD9AEC5CD60F490 3D52E0C6D887D46CDEF9FCD0FD3786DC keyset1_key3 7649ABAC8119B246CEE98E9B12E9197D keyset2_key1 0EDB3843990CC5381332F0E343590CBD D5978227ACF17D62AED789DE8EB7A192 A3E783098F917F8FD4621F1BB5F74822 240E6DE31E8ADBAB67FF333AE8E1F91B keyset2_key2 36D05CC4574512F974886ACC28B60B69 2D890DE41353BD9B04E608FD747DF4D1 9BF75802531FD31EF350287675C94CD2 2F150F1790E3A58B89B5132074109675 keyset2_key3 7883552D40B174B01AEA9843EF37B793
- Added in 3.10. Seems to be Cinavia related?
SCEI_AD_SIGN AES CFB Keys
RIV0: 8ceb482d10befb61871b6407dcfce7a3 KEY0: 3683a2fae5e62fc59004db1911c0562f RIV1: 08080b7163e4fbabc2905023d430fc92 KEY1: c4b92b1e1fc6429ae63701340336a529
Modules
Notes
- in CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)
- With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms
- Likewise, the individual_info erk is 256 bit size, but only first half is used.
A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also : http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf
- <= 3.55:
- Randomfail present, thus when private key is unknown: use scekrit ;
- No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)
- 3.56:
- Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [1] ;
- No obfuscation added to loaders yet
- =>3.60:
- fixed the randomfail since 3.56, thus scekrit is of no use ;
- Obfuscation of keytable was added since 3.60 see Key Scrambling, which used ch72 ringbuffer seed for deobfuscation.
- "dec" in ldr table refers to the deobfuscated key as used by crypto engine ;
- "enc" in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable
Lv0Ldr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
lv0ldr (Internal) |
- ( SD ) | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
lv0ldr | 0.60+ | CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A |
F9205F46F6021697E670F13DFA726212 |
A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D |
001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3 |
0x33
|
lv0ldr | 030.001-050.013 ( CEB ) | B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222 |
B43661B9A79BAD9D8E2B046469CDA1E7 |
4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20 |
002CC736C7AD06D264E9AB663EB1F35F5DC159248C |
0x33
|
MetLdr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
metldr (Internal) |
- ( SD ) | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
metldr | - | C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B |
47EE7454E4774CC9B8960C7B59F4C14D |
C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019 |
00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670 |
0x20
|
Lv1ldr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
lv1ldr (Internal) |
SD 0.80 | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
lv1ldr (Internal) |
SD 0.80-3.31 | 014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 |
A17D6A522CB1B08F97DA8A82E97C12F7 |
72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 |
008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8 |
0x11
|
lv1ldr | 030.001-3.31 | B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222 |
B43661B9A79BAD9D8E2B046469CDA1E7 |
4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20 |
002CC736C7AD06D264E9AB663EB1F35F5DC159248C |
0x33
|
lv1ldr | 3.40-3.42 | B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646 |
A79B05D4E37B8117A95E6E7C14FB640E |
7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375 |
00033A699FDD2DA6CDD6CCC03B2C6145F998706F74 |
0x34
|
lv1ldr | 3.50 | 1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7 |
E034D31A80316960024D1B3D3164FDC3 |
7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398 |
005815D17125D04C33790321DE29EB6241365100B5 |
0x35
|
lv1ldr | 3.55 | 53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23 |
44E652661AC7584DBE08ECB810FB5FC0 |
733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9 |
004312C65347ACBE95CC306442FEFD0AF4C2935EB3 |
0x05
|
lv1ldr | 3.56 | 48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83 |
15DCF3C67147A45D09DE7521EECA07A1 |
85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C |
- | 0x07
|
lv1ldr | 3.60-3.61 | 5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5 |
DF0F50EC3C4743C5B17839D7B49F24A4 |
1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E |
- | 0x05
|
lv1ldr | 3.65-3.66 | BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951 |
569AF3745E1E02E3E288273CDE244CD8 |
21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C |
- | 0x07
|
lv1ldr | 3.70-3.74 | 41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE |
C8C98D5A5CE23AF5607A352AECACB0DC |
4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667 |
- | 0x12
|
lv1ldr | 4.00-4.11 | 557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74 |
7144D7574937818517826227EF4AC0B4 |
085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96 |
- | 0x13
|
lv1ldr | 4.20-Template:Latest | 10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD |
ED8699562C6AC65204FA166257E7FCF4 |
9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2 |
- | 0x14
|
Lv2Ldr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
lv2ldr (Internal) |
SD 0.80-3.31 | 014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 |
A17D6A522CB1B08F97DA8A82E97C12F7 |
72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 |
008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8 |
0x11
|
lv2ldr | 030.001-3.31 | 94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F |
9769BFD187B90990AE5FEA4E110B9CF5 |
AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D |
0070ABF9361B02291829D479F56AB248203CD3EB46 |
0x20
|
lv2ldr | 3.40-3.42 | 575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10 |
411CB18F460CE50CAF2C426D8F0D93C8 |
3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA |
0073076441A08CD179E5FACE349B86DA58B5B7BA78 |
0x21
|
lv2ldr | 3.50 | 6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68 |
603A36213708520ED5D745DEC1325BA5 |
5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3 |
0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD |
0x22
|
lv2ldr | 3.55 | 84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17 |
5B240444D645F2038118F97FD5A145D5 |
B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72 |
009D4CBA2BFB1A8330D3E20E59D281D476D231C73A |
0x32
|
lv2ldr | 3.56 | EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359 |
9CA9282DC7FA9F315EF3156D970B7CD4 |
0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699 |
- | 0x33
|
lv2ldr | 3.60-3.61 | 88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC |
8D18E8E525230E63DE10291C9DD615BF |
86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027 |
- | 0x32
|
lv2ldr | 3.65-3.66 | 688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0 |
75E0239D18B0B669EAE650972F99726B |
008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA |
- | 0x33
|
lv2ldr | 3.70-3.74 | E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254 |
15058FA7F2CAD7C528B5F605F6444EB0 |
438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED |
- | 0x11
|
lv2ldr | 4.00-4.11 | A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97 |
BBE7799B9A37CB272E386618FDFD4AEC |
5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8 |
- | 0x07
|
lv2ldr | 4.20-Template:Latest | 0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03 |
9B79374722AD888EB6A35A2DF25A8B3E |
1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50 |
- | 0x14
|
IsoLdr
Module | Version | Revision | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|---|
isoldr (Internal) |
SD 0.80-3.31 | 0x01 | 9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9 |
2C1F4C82FF3A796D3A772CEEF010ECA4 |
625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782 |
00D19A1B338041F7C31062B9C40E725E1DA5D7C11A |
0x20
|
isoldr | 0.80-3.31 | 0x01 | 8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4 |
C82D015D46CF152F1DD0C16F18B5B1E5 |
733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29 |
009BE892E122A5C943C1BB7403A67318AA9E1B286F |
0x36
|
isoldr | 3.40-3.42 | 0x01 | 101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D |
8D2E9C6297B8AD252998458296AC773C |
138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625 |
00849DBC57D3B92F01864E6E82EB4EF0EF6311E122 |
0x32
|
isoldr | 3.50 | 0x01 | 3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843 |
A414AC1DB7987E43777651B330B899E1 |
1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F |
0085B4B05DEBA7E6AD831653C974D95149803BB272 |
0x33
|
isoldr | 3.55 | 0x01 | BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37 |
0207A479B1574F8E7F697528F05D5435 |
917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58 |
00294411363290975BA551336D3965D88AF029A17B |
0x03
|
isoldr | 3.56 | 0x01 | 311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE |
7BB8B3F5AC8E0890E3148AE5688C7350 |
3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD |
- | 0x08
|
isoldr | 3.60-3.61 | 0x01 | 8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093 |
FFF9CACCC4129125CAFB240F419E5F39 |
098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556 |
- | 0x03
|
isoldr | 3.65-3.66 | 0x01 | E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592 |
D292A7BD57C0BB2EABBCA1252FA9EDEF |
2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5 |
- | 0x08
|
isoldr | 3.70-3.74 | 0x01 | 072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51 |
8516A81F02CF938740498A406C880871 |
5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D |
- | 0x21
|
isoldr | 3.70-3.74 | 0x0100 | 786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8 |
94662F13D99A9F5D211C979FFDF65FE3 |
912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B |
- | 0x0E
|
isoldr | 4.00-4.11 | 0x01 | 4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD |
4F1E3EF07D893A4714B1B3D5A4E50479 |
4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702 |
- | 0x11
|
isoldr | 4.00-4.11 | 0x0100 | 16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B |
0E50DB6D937D262CB0499136852FCB80 |
AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC |
- | 0x0F
|
isoldr | 4.20-Template:Latest | 0x01 | 63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086 |
953F6A99891B4739358F5363A00C08B9 |
26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612 |
- | 0x15
|
isoldr | 4.20-Template:Latest | 0x0100 | B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C |
B96EA32CB96EA32DB96EA32DB96EA32C |
2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151 |
- | 0x02
|
Spp verifier
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
spp_verifier (Internal) |
- SD | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
spp_verifier | 0.80-3.55 | 56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A |
007E6B268EF1E986D10A9889CF93A8CB |
265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A |
0001608EF3BACAFFB8C3A5958A24F758325B62B08C |
0x22
|
spp_verifier | 3.56 | 7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0 |
B889290922B002F57086B818A8FDE3CC |
71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63 |
- | 0x22
|
spp_verifier | 3.60-3.61 | ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2 |
3E05572881C5BC845D310EAC28497B08 |
504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E |
- | 0x13
|
spp_verifier | 3.65-3.66 | E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4 |
0F23BBED0473B4899AD793AC76D8F722 |
934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F |
- | 0x22
|
spp_verifier | 3.70-3.74 | 4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0 |
3B6203C2730D283F978A12D5390DD747 |
0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8 |
- | 0x23
|
spp_verifier | 4.00-4.11 | 11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF |
67B49380C74FFB15AD929E8C819586AD |
5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3 |
- | 0x04
|
spp_verifier | 4.20-Template:Latest | D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5 |
6D308B59BC9054B12C833359D31BAE77 |
0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5 |
- | 0x07
|
RvkLdr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
rvklist (Internal) |
- SD | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
rvklist | 030.001-3.55 | 03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF |
8B5D7876F40A9E1E9AC2B22F51B60BDF |
9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7 |
00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF |
0x29
|
rvklist | 3.56 | 22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE |
D5D4B8ED62B6CCA0249A79776E136975 |
51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B |
- | 0x32
|
rvklist | 3.60-3.61 | BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3 |
B20A23079516205525683D8058379CBF |
9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6 |
- | 0x33
|
rvklist | 3.65-3.66 | 1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C |
501819323BFCF9FB99396B46B70A97E7 |
6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448 |
- | 0x30
|
rvklist | 3.70-3.74 | 4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4 |
0E5CB28FA2666E3ED45289DABC67DDC2 |
758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371 |
- | 0x31
|
rvklist | 4.00-4.11 | 99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E |
182CC801794A2F7027BB76D29D598550 |
6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C |
- | 0x02
|
rvklist | 4.20-Template:Latest | 695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17 |
a8ba3e4e63b2bb06fc0ce57e3bb8fc46 |
7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a |
- | 0x12
|
Spu Pkg Rvk Verifier
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
spu_pkg_rvk_verifier (Internal) |
- SD | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
spu_pkg_rvk_verifier | 0.80-3.55 (pkg) | A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031 |
4ACEF01224FBEEDF8245F8FF10211E6E |
41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 |
00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 |
0x23
|
spu_pkg_rvk_verifier | 3.56-Template:Latest (spkg) | F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD |
59D28DB4ADDFB40B7D768BC9667C67B1 |
5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0 |
- | 0x17
|
Updater (CEB units Ebootroms)
Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated)
Module | Version | ERK | RIV |
---|---|---|---|
updater | E/rXXX | D9580C4D6349692159CDDFC33F53908B99817C618D61549DDDEA247E57788920 |
CB445249CE6A9FEB01DF02C7B94938E1
|
individual_info | E/rXXX | 987C95CC38C286D0E36252B867BCEBA1D0BE92DE84F83A26DE1E670683066243 |
1AAEBF3ED6EB1B295DAC75963DB37651
|
toolupdatedec (Communication Processor Updater binary)
Module | Target | Filename | ERK | RIV |
---|---|---|---|---|
toolupdatedec | TCP510/TCP520 | reftool_cp_xxx.bin | E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F |
File dependant (the first 16 bytes of the file)
|
toolupdatedec | DTP-T1000 | psptoolupdate.bin | A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB |
File dependant (the first 16 bytes of the file)
|
PS3 Suffix for NIDS
6759659904250490566427499489741A
Bluray Drive Keys (retrieved from bluray drive firmware)
5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F 97EC3F4F8751F22B7FFCACA83803EAF7
or
E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7 5BCE24712335AF70E570F6559A29F34D
- Bluray drive firmware uses same curve as KIRK 0xc 0xd 0x10 and 0x11 services.
- Signature is at the bottom of the firmware. (0x7fd0)
- it's highly likely to be cbc 256 aes
XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE
It can be used to decrypt emboot and another perdevice areas.
EID0 Section Keys
Public key00: 94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A
Curve00 sha1: 9035B33F58DFAEF389FD49187F93C4FC2D2DD268
Curve:
A34D0C98B2A8DEA81E7C3FF0757C5B89 1B8523E1A34D0C98B2A8DEA81E7C3FF0 757C5B891B8523DE929F2B86E0F6525F FDC819D76D5F139A2F8A49B300A34D0C 98B2A8DEA81E7CEC7E21A8FF20DC9B8F AF755FD420216829E389548D397246E6 6DF2EC4B7C9B308B62B9CEFFA3F0071A 5C396F67FCE4A3A683
Public key06: 06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE
Curve type06: 2 (vsh)
Public key0A: 4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A
Curve type0A: 2 (vsh)
PSP ID-Storage Keys
IDPS
Public key00: 4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E
Curve type00: 2 (vsh)
Public key01: 06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE
<-Same as EID0 Public key06
Curve type01: 2 (vsh)
Public key02: 3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5
Curve type02: 2 (vsh)
Public key03: CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786
Curve type03: 2 (vsh)
Public key04: 08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6
Curve type04: 2 (vsh)
UMD
Public key: 4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A
<-Same as EID0 Public key0A
Curve type: 2 (vsh)
Appldr
selftype | version | revision | fw | type | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|---|---|---|
app Internal SD | 0.80-0.92 | 0x00 | 0.80++ | dec | 014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 |
A17D6A522CB1B08F97DA8A82E97C12F7 |
72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 |
008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8 |
0x11
|
app | 0.80-0.92 | 0x00 | 0.80++ | dec | 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04 |
4A0955D946DB70D691A640BB7FAECC4C |
6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 |
006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4 |
0x21
|
app | 0.92-2.36 |
0x01 | 0.92++ | dec | 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB |
6F0F25E1C8C4B7AE70DF968B04521DDA |
94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526 |
003DE80167D2F0E9D30F2145144A558D1174F5410C |
0x11
|
app | ?-2.36 | 0x02 | 1.00++ | dec | 4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A |
90C127A9B43BA9D8E89FE6529E25206F |
8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E |
00530446451C568968EBF7068B1F45C252D70EC942 |
0x13
|
seven | ?-2.36 | 0x00 ? | =>0.85 <=3.30 | dec | D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085 |
DC01280A6E46BC674B81A7E8801EBE6E |
A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4 |
0x11
| |
npdrm | ?-2.36 | 0x00 np | 1.00++ | dec | 8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86 |
7AAECC60AD12AED90C348D8C11D2BED5 |
05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440 |
|
0x0A
|
npdrm | 0.92-2.36 | 0x01 np | 1.00++ | dec | F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B |
A551CCB4A42C37A734A2B4F9657D5540 |
B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF |
00040AB47509BED04BD96521AD1B365B86BF620A98 |
0x11
|
app | 2.40-3.30 | 0x03 | 2.40++ | dec | C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E |
E0908163F457576440466ACAA443AE7C |
50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92 |
|
0x0B
|
npdrm | 2.40-3.30 | 0x03 np | 2.40++ | dec | 1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664 |
E31E206FBB8AEA27FAB0D9A2FFB6B62F |
3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D |
|
0x08
|
app | 3.40-3.42 | 0x04 | 3.40++ | dec | 838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA |
7FDBB2E924D182BB0D69844ADC4ECA5B |
1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69 |
0074E922FDEE5DC4CDF22FC8D7986477F813400860 |
0x14
|
app | 3.40-3.42 | 0x05 | 3.40++ | dec | C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC |
15D3F191295C94B09B71EBDE088A187A |
B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7 |
|
0x15
|
app | 3.40-3.42 | 0x06 | 3.40++ | dec | 6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41 |
24BD1C19D2A8286B8ACE39E4A37801C2 |
71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95 |
|
0x2C
|
npdrm | 3.40-3.42 | 0x05 np | =>3.40 <=3.42 | dec | B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E |
86F56F9E5DE513894874B8BA253334B1 |
B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5 |
|
0x12
|
npdrm | 3.40-3.42 | 0x04 np | 3.40++ | dec | BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706 |
ADF7B207A15AC601110E61DDFC210AF6 |
9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30 |
00B61A91DF4AB6A9F142C326BA9592B5265DA88856 |
0x16
|
npdrm | 3.40-3.42 | 0x06 np | 3.40++ | dec | 8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020 |
05719DF1B1D0306C03910ADDCE4AF887 |
2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E |
|
0x29
|
app | 3.50 | 0x07 | 3.50++ | dec | 945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55 |
1D5EFBE7C5D34AD60F9FBC46A5977FCE |
AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD |
002CF896D35DB871D0E6A252E799876A70D043C23E |
0x15
|
app | 3.50 | 0x08 | 3.50++ | dec | 2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13 |
5A4CEFD5A9C3C093D0B9352376D19405 |
6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5 |
|
0x16
|
app | 3.50 | 0x09 | 3.50++ | dec | F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B |
F4D535069301EE888CC2A852DB654461 |
1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99 |
|
0x2D
|
npdrm | 3.50 | 0x08 np | 3.50 only | dec | 8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6 |
908A75754E521EAC2F5A4889C6D7B72D |
91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B |
|
0x13
|
npdrm | 3.50 | 0x07 np | 3.50++ | dec | 3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3 |
E4897BE553AE025CDCBF2B15D1C9234E |
A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E |
009EF86907782A318D4CC3617EBACE2480E73A46F6 |
0x17
|
npdrm | 3.50 | 0x09 np | 3.50++ | dec | 0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A |
04AD3C2F122A3B35E804850CAD142C6D |
A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0 |
|
0x2A
|
app | 3.55 | 0x0A | 3.55+ | dec | 29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3 |
5D1FAB844107676ABCDFC25EAEBCB633 |
09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827 |
0010818ED8A666051C6198662C3D6DDE2CA4901DDC |
0x25
|
app | 3.55-? | 0x0B | 3.55++ | dec | A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3 |
E4792F2B9DB30CB8D1596077A13FB3B5 |
2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF |
|
0x26
|
app | 3.55-? | 0x0C | 3.55++ | dec | 9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA |
D43B1FA8BE15714B3078C23908BB2BCA |
7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB |
|
0x3D
|
npdrm | 3.55 | 0x0B np | 3.55 only | dec | BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F |
263057225873F83940A65C8C926AC3E4 |
BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437 |
|
0x23
|
npdrm | 3.55 | 0x0A np | 3.55++ | dec | 03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4 |
0A99D4D4F8301A88052D714AD2FB565E |
3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B |
|
0x27
|
npdrm | 3.55-? | 0x0C np | 3.55++ | dec | 357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92 |
D26E6DD2B74CD78E866E742E5571B84F |
00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57 |
|
0x3A
|
app | 3.56-? | 0x0D | 3.56++ | dec | 03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194 |
5ADB9EAFE897B54CB1060D6885BE22CF |
71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142 |
- | 0x12
|
app | 3.56-? | 0x0E | 3.56++ | dec | 39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03 |
90266C98CBAA06C1BF145FF760EA1B45 |
84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255 |
|
0x27
|
app | 3.56-? | 0x0F | 3.56++ | dec | FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B |
64F50296CF8CF49CD7C643572887DA0B |
0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1 |
|
0x3A
|
npdrm | 3.56 | 0x0E np | 3.56 only | dec | 71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B |
9DED878CB6BA07121C0F50E7B172A8BF |
387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3 |
|
0x29
|
npdrm | 3.56 | 0x0D np | 3.56++ | dec | 337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957 |
8405C88E042280DBD794EC7E22B74002 |
9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1 |
|
0x18
|
npdrm | 3.56 | 0x0F np | 3.56++ | dec | 135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291 |
4070C898C2EAAD1634A288AA547A35A8 |
BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433 |
|
0x3B
|
app | 3.60-3.61 | 0x10 | 3.60++ | dec | A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F |
7A203D5112F799979DF0E1B8B5B52AA4 |
50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934 |
|
0x25
|
npdrm | 3.60-3.61 | 0x10 np | 3.60++ | dec | 4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61 |
C0F2AB86E6E0457552DB50D7219371C5 |
64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213 |
|
0x27
|
app | 3.60-3.61 | 0x11 | 3.60++ | dec | 0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD |
97AF39C383E7EF1C98FA447C597EA8FE |
2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D |
|
0x26
|
npdrm | 3.60-3.61 | 0x11 np | =>3.60 <=3.61 | dec | F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195 |
D3A7C3C91CBA014FCBCA6D5570DE13FF |
97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28 |
|
0x23
|
app | 3.60-3.61 | 0x12 | =>3.60 <=4.11 | dec | D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715 |
25589F01B97B9BE1E07447A3CE7F06B9 |
3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B |
|
0x3D
|
npdrm | 3.60-3.61 | 0x12 np | =>3.60 <=4.11 | dec | D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374 |
211B52440AB7066A53121106FEB29FD5 |
EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C |
|
0x3A
|
npdrm | 3.65-3.66 | 0x13 np | 3.65++ | dec | 265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46 |
8DEA5FF959682A9B98B688CEA1EF4A1D |
9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8 |
|
0x18
|
app | 3.65-3.66 | 0x13 | 3.65++ | dec | DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94 |
CB5DD4BE8CF115FFB25801BC6086E729 |
B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917 |
|
0x12
|
app | 3.65-3.66 | 0x14 | 3.65++ | dec | 491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E |
F98843588FED8B0E62D7DDCB6F0CECF4 |
04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E |
|
0x27
|
npdrm | 3.65-3.66 | 0x14 np | =>3.65 <=3.66 | dec | BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860 |
22C19C5522F7A782AFC547C2640F5BDE |
3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F |
|
0x29
|
app | 3.65-3.66 | 0x15 | =>3.65 <=4.11 | dec | 324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4 |
A37B2139FBCF62F6B41F796A594440C8 |
A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694 |
|
0x3A
|
npdrm | 3.65-3.66 | 0x15 np | =>3.65 <=4.11 | dec | 3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F |
ABF2DA36D993554FB060322DC51097F7 |
497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569 |
|
0x3B
|
app | 3.70-3.74 | 0x16 | 3.70++ | dec | A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C |
62773C70BD749269C0AFD1F12E73909E |
566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF |
|
0x30
|
npdrm | 3.70-3.74 | 0x16 np | 3.70++ | dec | 7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B |
4AD981431B98DFD39B6388EDAD742A8E |
62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1 |
|
0x25
|
app | 3.70-3.74 | 0x17 | 3.70++ | dec | 4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46 |
954A86C4629E116532304A740862EF85 |
3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666 |
|
0x08
|
npdrm | 3.70-3.74 | 0x17 np | =>3.70 <=3.74 | dec | F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F |
FC5FA12CA3D2D336C4B8B425D679DA55 |
19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA |
|
0x15
|
app | 3.70-3.74 | 0x18 | =>3.70 <=4.11 | dec | 1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997 |
BF8D6B1887FA88E6D85C2EDB2FBEC147 |
64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494 |
|
0x11
|
npdrm | 3.70-3.74 | 0x18 np | =>3.70 <=4.11 | dec | 1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133 |
402666C76D795D228089810DDC128D14 |
ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A |
|
0x15
|
app | 4.00-4.11 | 0x19 | 4.00++ | dec | 3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297 |
6153DEE781B8ADDC6A439498B816DC46 |
148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268 |
|
0x31
|
npdrm | 4.00-4.11 | 0x19 np | 4.00++ | dec | FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3 |
F72C1D80FFDA2E3BF085F4133E6D2805 |
637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42 |
|
0x24
|
app | 4.00-4.11 | 0x1A | 4.00++ | dec | 5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9 |
1AC8FA3B3C90F8FDE639515F91B58327 |
BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23 |
|
0x17
|
npdrm | 4.00-4.11 | 0x1A np | =>4.00 <=4.11 | dec | 751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8 |
23AE4ADA4D3F798DC5ED98000337FF77 |
1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36 |
|
0x1A
|
app | 4.00-4.11 | 0x1B | =>4.00 <=4.11 | dec | 66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B |
9F7B5713A5ED59F6B35CD8F8A165D4B8 |
4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB |
|
0x12
|
npdrm | 4.00-4.11 | 0x1B np | =>4.00 <=4.11 | dec | BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B |
D03979E47D236BD278EC7331B7DA0BD4 |
4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848 |
|
0x17
|
app | 4.20-Template:Latest | 0x1C | 4.20++ | dec | CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752 |
FD40664E2EBBA01BF359B0DCDF543DA4 |
36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893 |
|
0x09
|
npdrm | 4.20-Template:Latest | 0x1C np | 4.20++ | dec | 8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F |
246F4B8328BE6A2D394EDE20479247C5 |
503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762 |
|
0x30
|
app | 4.20-Template:Latest | 0x1D | 4.20++ | dec | D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E |
ACB9945914EBB7B9A31ECE320AE09F2D |
430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879 |
|
0x1A
|
seven | 4.20-Template:Latest | not "0x1E" | 4.20++ | dec | 46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9 |
BF036387CDB613C0AC88A6D9D2CC5316 |
A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952 |
|
0x0F
|
klicensee
klic_dec_key
klic_dec_key : F2FBCA7A75B04EDC1390638CCDFDD1EE
See: http://pastie.org/private/k2vlnqi6h8onbkxhpjuxg
klic_dec_old_key : DC41D59080BFFF45547D0B3A12E591D3
klic_dev_key
Found inside ps1_netemu.self
Used as klicensee for ISO.BIN.EDAT
klic_dev_key : 52C0B5CA76D6134BB45FC66CA637F2C1
klic_free_key
see NPDRM OMAC Keys
klic_free_key : 72F990788F9CFF745725F08E4C128387
RIF's act.dat index decryption key
actdatix_dec_key : DA7D4B5E499A4F53B1C1A14A7484443B
Actually in vsh.self
riv_key
riv_key : 00000000000000000000000000000000 (former posted value was the sha1 of 0, not a proper key. iv is all zeroes - see also :/)
Actually in appldr
klicensee constant
klicensee_const : 5E06E04FD94A71BF0000000000000001
Actually in lv2_kernel.self
klicensee(psp)
Found inside psp_emulator.self
Used as klicensee for ISO.BIN.EDAT
klicensee for psp minis:
klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E
klicensee for psp remasters:
klic_pe : 0DB85732366CD734FC879E743343BB4F
vsh pub + curvetable
pub : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B curves : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92 F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520 inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9 FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF
Notes:
- It is used for rif/act.dat signatures, for example.
vsh-pub-curves.rar (367 Bytes)
Snowden Key (in vsh.elf or vshnet.prx into old firmwares)
9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397
VSH CryptoEngine Sha1Hmac keys
key0 685E2534695D79096F57640044315B515E0C7E55 key1 46753933634D1A1D464142752110116F2C5E7836 key2 59CB6067574D873CEFD7B75A300529C18BFB75ED key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2 key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5 key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48 key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933
NPDRM stuff
http://img24.imageshack.us/img24/9083/snapshote.png
GPKG/SELF ECDSA signature
Public key: E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9
Public bak: D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A
Curve type: 2 (vsh)
NPDRM OMAC Keys
npdrm-omac-key-1: 72F990788F9CFF745725F08E4C128387 npdrm-omac-key-2: 6BA52976EFDA16EF3C339FB2971E256B npdrm-omac-key-3: 9B515FEACF75064981AA604D91A54E97
PSISOIMG0000
See also : PSISOIMG0000
Public key:
948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773
Private key:
00bf21224b041f29549db25e9aade19e720a1fe0f1
Curve type: 2 (vsh-curves, but can be found in ps1_netemu, too)
This key is also used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes.
location: inside ps1_newemu.self (example from 3.55, but same as 2.10 and higher):
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00126AB0 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡>Œ¯Õº..ÎCDa»2 00126AC0 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.ÓO[bG§ý 00126AD0 A8 6D F6 97 90 19 67 73 ¨mö—..gs
and ps1_netemu.self (example from 3.55, but same as 1.70 and higher):
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0016FA10 94 8D A1 3E 8C AF D5 BA 0E 90 CE 43 44 61 BB 32 ”.¡>Œ¯Õº..ÎCDa»2 0016FA20 7F E7 E0 80 47 5E AA 0A D3 AD 4F 5B 62 47 A7 FD .çà€G^ª.ÓO[bG§ý 0016FA30 A8 6D F6 97 90 19 67 73 ¨mö—..gs
DOCUMENT.DAT
des key: 39F7EFA16CCE5F4C
des iv: A819C4F5E154E30B
Location: ps1_netemu.self
PS2 Keys
MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 <-mc_iso MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A <-mc_iso MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 <-mc_iso MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 <-mc_iso MC_CHALLENGE_MATERIAL 2C5BF48D32749127 <-mc_iso MG_KBIT_MATERIAL 35C860019222BB60 <-me_iso MG_KC_MATERIAL 8C2BD03EC245C56D <-me_iso MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 <- me_iso MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 <- me_iso META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 <- sb_iso DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 <- sb_iso VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 <- sb_iso META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 <- sb_iso DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 <- sb_iso VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 <- sb_iso
KIRK
- Note: KIRK CMD11 isn't vulnerable to retrieval of private key. KIRK1 is.
see also:
- https://github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication
- https://code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c
- http://wololo.net/talk/viewtopic.php?f=6&t=7224
- http://jpcsp.googlecode.com/svn-history/r2166/trunk/src/jpcsp/crypto/CryptoEngine.java [2] / https://code.google.com/p/jpcsp/source/browse/trunk/src/jpcsp/crypto/KeyVault.java [3]
Private-Public Crypto
// KIRK CMD1 ECDSA Private Key kirk1_priv = F392E26490B80FD889F2D9722C1F34D7274F983D
// PSP EDAT ECDSA Private Key edat_priv = E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD
// NPUMDIMG ECDSA Private Key priv_key_npumdimg = 14B022E892CF8614A44557DB095C928DE9B89970
// KIRK1 ECDSA Private Key kirk1_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 kirk1_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39
// PSP EDAT ECDSA Public Key edat_pub_x = 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521 edat_pub_y = 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D
// NPUMDIMG ECDSA Public Key npdu_pub_x = 0121EA6ECDB23A3E2375671C5362E8E28B1E783B npdu_pub_y = 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B
/* ECC Curves for Kirk 1 and Kirk 11 */ // Common Curve paramters p and a ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon
// Kirk C,D,10,11,(likely 12)- Unique curve parameters for b, N, and base point G for Kirk C,D,10,11,(likely 12) service // Since public key is variable, it is not specified here ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B// mon ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127 Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF
// KIRK 1 - Unique curve parameters for b, N, and base point G // Since public key is hard coded, it is also included ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9 ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0
Private Crypto
// KIRK CMD1 AESCBC128-CMAC key kirk1_key = 98C940975C1D10E87FE60EA3FD03A8BA
// KIRK CMD4 and CMD7 AESCBC128 key table kirk7_key02 = B813C35EC64441E3DC3C16F5B45E6484 // New from PS3 kirk7_key03 = 9802C4E6EC9E9E2FFC634CE42FBB4668 kirk7_key04 = 99244CD258F51BCBB0619CA73830075F kirk7_key05 = 0225D7BA63ECB94A9D237601B3F6AC17 kirk7_key07 = 76368B438F77D87EFE5FB6115939885C // New from PS3 kirk7_key0C = 8485C848750843BC9B9AECA79C7F6018 kirk7_key0D = B5B16EDE23A97B0EA17CDBA2DCDEC46E kirk7_key0E = C871FDB3BCC5D2F2E2D7729DDF826882 kirk7_key0F = 0ABB336C96D4CDD8CB5F4BE0BADB9E03 kirk7_key10 = 32295BD5EAF7A34216C88E48FF50D371 kirk7_key11 = 46F25E8E4D2AA540730BC46E47EE6F0A kirk7_key12 = 5DC71139D01938BC027FDDDCB0837D9D kirk7_key38 = 12468D7E1C42209BBA5426835EB03303 kirk7_key39 = C43BB6D653EE67493EA95FBC0CED6F8A kirk7_key3A = 2CC3CF8C2878A5A663E2AF2D715E86BA kirk7_key44 = 7DF49265E3FAD678D6FE78ADBB3DFB63 // New from PS3 kirk7_key4B = 0CFD679AF9B4724FD78DD6E99642288B //1.xx game eboot.bin kirk7_key53 = AFFE8EB13DD17ED80A61241C959256B6 kirk7_key57 = 1C9BC490E3066481FA59FDB600BB2870 kirk7_key5D = 115A5D20D53A8DD39CC5AF410F0F186F kirk7_key63 = 9C9B1372F8C640CF1C62F5D592DDB582 kirk7_key64 = 03B302E85FF381B13B8DAA2A90FF5E61 //KIRK Unknown 100 key kirk_unk100 = 000102030405060708090A0B0C0D0E0F
// KIRK CMD0x10 key kirk10_key = 475E09F4A237DA9BEFFF3BC077143D8A
// CHNNLSV SaveData keys sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF sdHashKey3 = 36A53EACC5269EA383D9EC256C484872 sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203 sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86 sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B sdHashKey7 = EC6D29592635A57F972A0DBCA3263300
// AMCTRL keys amHashKey1 = 9C48B62840E6533F05113A4E65E63A64 amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445 amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E
Idpstealer Key?
DES encrypt 192? bit 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E 0000000000000000
Idpstealer Key Confusion
- here's the executable (with printf) :
https://mega.nz/#!FwsWwCoJ!eReYmfKNvEXMNdG7YLBrNJui1sxeN1FIRzpqEFQTikM
- here's the source (with printf) : http://pastie.org/private/slfjwzyshcrsq7mnycxc0w
- here's the specific function : http://pastie.org/10530594
- usage:
idpstealer.exe idps.bin
- output:
SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E
Sbox Values
D/L | hex | Note |
---|---|---|
[4] | S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGðÔ¢¯œ¤rÀ 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&6?÷Ì4¥åñqØ1. 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„ 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P<Ÿ¨ 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ"*.ˆFî¸.Þ^.Û 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®. 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p>µfH.ö.a5W¹†Á.ž 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T». |
Present in all SPU binaries that perform AES (see here) |
Inverse AES S-box
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С% 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’ 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„ 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE. 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t"з.5…вщ7и.uЯn 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ. 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV>KЖТy љЫАюxНZф 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_ 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61 а;M®*х°Ил»<ѓS™a 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&бi.cU!.} |
in another form (from updater in ebootroms) : http://pastie.org/10070142 | http://pastie.org/10070145
RCON
01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00
Shuffles
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F
ShiftRows tab
00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06
InvShiftRows tab
00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06
Td0/Te1
See [this] and [binaries] with sbox repeated 4 times
T5
Inside lv2_kernel see [this ]