Keys
Keys Notes
You can download the keys from: ps3keys (or for scetool here : scetool/data/)
Location
keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys
Naming
naming:
- file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np
- (NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)
- file suffix: .092 .315 .341 .350 .355 .356
- (NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)
- key file (erk): %s-key-%s
- iv file (riv): %s-iv-%s
- ctype file (curvetype): %s-ctype-%s
- pub file (public): %s-pub-%s
- priv file (private): %s-priv-%s
Key Table Structure
generic in loaders
Keys are kept in tables and indexed by the sdk_type in the SELF header.
struct key_obj { uint8_t key[0x20]; uint8_t iv[0x10]; uint8_t pub[0x28]; uint32_t curve_type; uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines }
appldr specific
typedef struct _appldr_key_container
{
/* start-end (length) */
u8 key[32]; /* 0x00-0x19 (0x20) */ (AES:ERK - 256bit Encryption Round Key) */
u8 iv[16]; /* 0x20-0x2f (0x10) */ (AES:RIV - 128bit Reset Initialization Vector) */
u8 pub[40]; /* 0x30-0x57 (0x28) */ (ECDSA:public - 320bit) */
u32 ctype; /* 0x58-0x5b (0x04) */ (ECDSA:curvetype - 32bit formatted 8bit value) */
u32 null; /* 0x5c-0x5f (0x04) */ (always zero - 32bit formatted) */
/* 0x00-0x5f (0x60) */ (total per revision/type entry - 768bit) */
} appldrKeyContainer;
appldrKeyContainer rev0x00_0x0c_1[13];
appldrKeyContainer rev0x00_0x0c_2[13];
appldrKeyContainer unknown;
appldrKeyContainer npdrm_1[13];
appldrKeyContainer npdrm_2[13];
appldrKeyContainer revoke;
Curves Notes
- First curve (type 0) is probably reserved (and cannot be used because it is an invalid curve that serves no purpose since it's fully zeroed).
- Second curve (?type 1?) is ONLY used in KIRK command 1 parameters (which means that some of the keys/curves from PSP were ported to PS3).
- Third curve (type 2 - vsh) is the most widely used curve and serves general use purpose.
- EID0 section 0 (and certainly EID0 sections 1, 2, 3, 4 too) uses another curve, found by naehrwert in 2013. See EID0 Keys.
Key Scrambling
Starting with PS3 firmware 3.60 loader keys have been encrypted. Look here (dead link) for a tool that decrypts them. Besides that, there is an implementation (dead link) of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side.
Root scramble keys
type | version | key | obfuscated key |
---|---|---|---|
root | 3.60-3.61 | 844F80F3C57C455C7F09 |
was not obfuscated |
root | 3.65-3.66 | 865128F745845947A0CE |
C713D2DFDFD47DDAB4D4B2666E904577
|
root | 3.7x | 0DAD161222CDDB00A631 |
06EE2ABE898525C0EC8A836FDEB60F9B
|
root | 4.00-4.1x | D029857926C7A918D48E |
8E18822A713B37FEBA2EC0092FC84D3B
|
root | 4.20-4.91 | F5FD0DFD54B738FC8895 |
8B77B209CD58C688CF5E38C8FAFD781B
|
Root crypto SPU keys
version | erk | riv |
---|---|---|
4.20-4.91 | E044C1E29C53FEF2E064E31207D09D48676719789D59E5C1F004D002390F2360 8350EBCCCA16A69A08E2A813F18B92EF688B163CB6C4781F0285AEAD4DAB0FD2 555A7B10D87DA8C9257136546E1A6A33782DC8C1B1A888A3FB2000EFBC12DE7F FC6EC40EC3782C8C53625B96E72334E67073EC2C0395A5DB0A1CACA119E61A86 ADA4401ADD1CC764A0C2DB4D58E13F8B23515AB750DCED2BAE626CCE7FD07242 E2BF4D2503282798E4A736ACC388412D |
20385B4B1819FD8E691BBEF17001392B
|
Lv0 crypto PPU keys
version | erk | riv |
---|---|---|
4.20-4.91 | 31A57D41FF28CD29721B41D347F48809D01E8C70A8F297D2F652C298315D9D4F D3ADB79D9BC55C38BF49F8664FB84281145A935130D5A22AAE065D2B3542175D 36337FA72E0C24F10B8605BB1957D81D6DA1D45DCEBF6B503283905BC1F656CC D23F408234778FBCA0DAD68C625951E20C2CF06A001CDA65E715148CF1EEB294 D2C4EABF968CFA6F23608F6F6257F317F53FD595A656EDC8739596EA6F254292 17EC4391566D330DB1FE95CDF45B9F3B |
B5F9F0E46307DBFA5F54BE397475E2BB
|
Scramble keys
type | version | key1 | iv1 | key2 | iv2 |
---|---|---|---|---|---|
isoldr | 3.60-3.61 | 5389A6DFA8567D43A80DA6DAB90EE946 |
A51A2C7960AC1BE43AA0FB7695094188 |
212E7E92FF1FB75AE5C1323037C34693 |
90AF09A666BB0C663BF2FC8E5338B7B8
|
isoldr | 3.65-3.66 | E37A763FD7A559CFD7E1E2DA5C8CBAC4 |
198361A904E748381CB9AA1DF5CCAB17 |
23EAD00FC78D9A8B7785EB600124238C |
61B0D045DF5727EFC19E5BE53BE70F14
|
isoldr | 3.70-3.74 | 9FD83EA32E9EAA0EF54AD0CFBB60D1DF |
194B649CDA9F4D814CD119C603E49FB5 |
A9709BE3E8043BA24635A2617541E9D5 |
F06A5B2FEF9CA87B1759DC53AEE1A3B5
|
isoldr | 4.00-4.11 | FFD6342FC86B81F0E56C6867D618D72A |
A51A2C7960AC1BE43AA0FB7695094188 |
194922A1EEB01E614884A44D1D7B7FC1 |
90AF09A666BB0C663BF2FC8E5338B7B8
|
isoldr | 4.20-4.91 | 4DEA657828657CA86AB93E2162592B97 |
F7B28A650B22AA54A9104CB9D96A4860 |
CE2D1A7AA4F4434058F0C8A64400CBF5 |
27C1B2C611EDC0E4A68A642FBB92A3A7
|
lv1ldr | 3.60-3.61 | F92C8666EFFBAC7EB583E54A257F7C05 |
F2E70BC4BAC10C3D8DDBB7DC23053F9A |
DDF6A5B143C1141FEED01CDA719705C3 |
018E695C3A29AF6E746A73CBF73DBDFD
|
lv1ldr | 3.65-3.66 | 546DE455AB15F33546D2296C2535FA44 |
ACA9C00DA6D778A95EBD9D76E659C14F |
AB82EF1F62CC382CF2880A870499AE89 |
6ECB2AC4DA8D400F0167F1EB9FD8D7F1
|
lv1ldr | 3.70-3.74 | F98E56F3CB0D68797E3D81F0BE36CFBD |
7DA5A5487AFA3032BF49D40CEBEC2480 |
7EAFED452D621269CB7EF46D7BE3DAD9 |
A5C6E2A25C2DD09D6597F69EEB3A2CE5
|
lv1ldr | 4.00-4.11 | 80863EDBAE50DD4B16125FC9321BBC24 |
1A9E31FEBD603A9CBE4ECD6026292466 |
D4E2AA7293192CB1600D537A9E832F2D |
4503E4E505A773C55E0B8E1332341287
|
lv1ldr | 4.20-4.91 | AC19D5DB427351434DC6DA3BD6E3DE6C |
66E68237D5B7228AA2F057B6043768E1 |
466CD2F735628B8EF99D1793063BBB3B |
761907BA41A7945028D8FD8305B25BD2
|
lv2ldr | 3.60-3.61 | A25E7F097B2FC7B1082032C4387DB335 |
0655809B26DF5F29E4E740D950A8CB53 |
6B97507247CD680FE56D9E19D06DFC71 |
B72B9DBB5C2CC74EB75C7B9815DBD5D8
|
lv2ldr | 3.65-3.66 | 4B973A45A23894CBF0CDFC168B7EFB31 |
2210B3103E7EDFD8CE0B25551B1D4003 |
858CFE093654E3EFA16FCCE5F73C9591 |
481472B4DF63EA5F883DAA2872EE5D2F
|
lv2ldr | 3.70-3.74 | 85AEC67CB85BD04D3E7D3D76AA604FF5 |
51B40C084A81C9BE35108FFC0C008F64 |
616004C6C2D614737106FE41668826A7 |
A765A845AAB477EABFEF4274ADA6AF04
|
lv2ldr | 4.00-4.11 | 020397E6D292288F80659F06E2DACEFB |
4CC9A8A9EED889070F066EC9A7CADA2B |
577BA1CBF1FD40A3EF53C9B5DAC3AC60 |
B64BF3D04FBB3F8D29F9E63A97DF3DA9
|
lv2ldr | 4.20-4.91 | 872D02292EE7ED3544AFF20EEA5E6F0C |
2E0CBBD250150410302F7E8B33039EF3 |
A02BA1F74446E4BAE04AF5CF13D94154 |
2009879EED2F443367C80B62F9D1748F
|
appldr | 3.60-3.61 | EE409F8CD0B7F8AF17769D5F6D67EA3F |
6BF7B2D5B0ED87EF4CF601D53EEA111A |
2149690206DD0ABC0CD5367C4AF2C810 |
39D8E32CF3F1558902247F733D5284BF
|
appldr | 3.65-3.66 | D1FF8A1B7AD27A186B0F1E2FFF5C2B65 |
4D5EC61604BCE8250E62600376061878 |
8F40C9F3CEF5284F5F432BD906ECDF24 |
0B107F57C095B31EF15B95FFEC5134B2
|
appldr | 3.70-3.74 | 2AF91823CE38598E8D66245F698AB572 |
D1A74E3DED98145F023F07FFB60D2B1D |
04BE8DD318D3E7454A166296B022F88D |
16D3B1E7B007FDFE101C029B5F39C761
|
appldr | 4.00-4.11 | 6BFAFA124D4B88841BCB861364C32826 |
3F7679B0A1430C490C1F249EAA468D2C |
4338700B5FA64276DD3E57806ED679FD |
CFCAE1AF6F98E5651CBB021D78DD8F1B
|
appldr | 4.20-4.91 | AAF65A91EC372C690969090F59E53C3E |
A5798C254313BC5416951E24EAD3C985 |
66BCB417D14A2B592640801C11B7B49B |
2FF236152A4776DAD39B509244E8F5C2
|
Note: key1/iv1 are used for unscramble scrambled keys. key2/iv2 are used for unscramble scrambled IVs.
Scrambled keysets
Type | Version | ERK | RIV |
---|---|---|---|
rvk_prg | 3.60-3.61 | FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4 |
E06DC9567BE0EA09D5D1A5355B996FC6
|
rvk_prg | 4.20-4.91 | 1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8 |
30B9F738238A015014A44DD57B3A1661
|
isoldr | 3.60-3.61 | 7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1 |
B3E9683977AE89DE9AFFE6330774505C
|
isoldr | 3.65-3.66 | 1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0 |
2E691E3343A55B99E8A935B0443BD67B
|
isoldr | 3.70-3.74 | 7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7 |
E46F02FDCA9F40CC5CD715D930190FE0
|
isoldr | 4.00-4.11 | B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83 |
2912F5FC4C4FF400940B369193303D16
|
isoldr | 4.20-4.91 | A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D |
36762D06A6F6FBFFE342D8853A3CD440
|
lv1ldr | 3.60-3.61 | 18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812 |
9B32B20FA77280F1095EA13F1C2D5C99
|
lv1ldr | 3.65-3.66 | 760EA11735B587072EDD4FFD0BD31DD3BE9AB82188A344C81E7E4710F9607779 |
AC559E2326390686B064B6AC45753117
|
lv1ldr | 4.20-4.91 | 189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3 |
E372B32F7E439D30AC6CEC68CA23D903
|
lv2ldr | 3.60-3.61 | 451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F |
E8831E56EF9FA4D8D4BF7A6E78025644
|
lv2ldr | 3.65-3.66 | 2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739 |
FD9D731564C1D1F0A4258667100D1F17
|
lv2ldr | 3.70-3.74 | 7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4 |
90A06C54C727844AB5300BB6AB54C537
|
lv2ldr | 4.00-4.11 | ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794 |
CF33BDA9F55C71BD9F38B31162FCB0E3
|
lv2ldr | 4.20-4.91 | B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328 |
2D4C6F9F0AAF26A728CA166D03449321
|
lv2ldr::rlist | 4.20-4.91 | 62A5AEA5627F387BBEBFE437D3F440C13761403CC3AD65FCDC5478468D048685 |
DF0AA5EC856B48CA091D8F42A27319D5
|
edat-key-0 | 4.20-4.91 | 270C4A349DE7A329BB04FD8642C43591 |
|
edat-hash-0 | 4.20-4.91 | 25790BA9D671FB125E53F013B0F9862E |
|
edat-key-1 | 4.20-4.91 | D1DF87B5C1471B360ACE21315A339C06 |
|
edat-hash-1 | 4.20-4.91 | 6D4BF3D7245DB294B6C3F9E32AA57E79 |
Key lists
sc_iso module 060.013.r010 - 4.75
1: //SRK (dynamic key, initial 0x10 bytes from system root info) 2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75) //ss::sc_key::series_key 2: 73636B65795F7365726965736B657900 (INTERNAL) 3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75) //ss::sc_key::series_key2 3: 73636B65795F7365726965736B657932 (INTERNAL) 4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56) //ss::sc_key::key_for_master 4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75) //ss::sc_key::key_for_master.2 (new one) 4: 73636B65795F666F725F6D6173746572 (INTERNAL) 5: (1.50+) //encrypted keyseed_for_srk2 (perconsole dynamic key) 6: (1.50+) //encrypted seed_for_backup (perconsole dynamic key) 7: (2.40+) //encrypted sherwood_ss_seed (perconsole dynamic key) 8: (2.40+) //encrypted ss_seed_one_more (perconsole dynamic key)
see also: http://pastie.org/3130817 / http://pastie.org/10206783
sb_iso_spu_module 083.006.r010 / 1.02
0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 <- ss::sb_iso::magic_px 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E <- ss::sb_iso::fix2_px 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 <- ss::sb_iso::fix1_px 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 <- ss::sb_iso::magic_dx 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF <- ss::sb_iso::fix2_dx 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 <- ss::sb_iso::fix1_dx
sb_iso_spu_module 3.41
6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4 <- ss::sb_iso::fix1_sx 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4 <- ss::sb_iso::fix2_sx 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E <- ss::sb_iso::magic_sx 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27 <- ss::sb_iso::fix1_zx A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121 <- ss::sb_iso::fix2_zx B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609 <- ss::sb_iso::magic_zx
note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)
sv_iso_spu_module 095.001 - 3.55
key_0: EF4F6A107742E8448BC1F9D8F2481B31 // key_0 is an AES128CBC key, used with zero iv iv_0(ss::giv): 2226928D44032F436AFD267E748B2393 key_0_0(ss::kms1): 126C6B5945370EEECA68262D02DD12D2 // key_0_0 is used with iv_0 to generate gen_key_0(ss::sv_auth::ks1) key_0_1(ss::kms2): D9A20A79666C27D11032ACCF0D7FB501 // key_0_1 is used with iv_0 to generate gen_key_1(ss::sv_auth::ks2) key_1(Kwm): 7CDD0E02076EFE4599B1B82C359919B3 // key_1 is used with iv_0 iv_1(ivs_aes): 3BD624020BD3F865E80B3F0CD6566DD0 // iv_1 is used with gen_key_0 and gen_key_1
This key and this IV are used to derive the disc encryption key:
key_2(Kh): 380BCF0B53455B3C7817AB4FA3BA90ED iv_2(IVh): 69474772AF6FDAB342743AEFAA186287
debug_disc_fallback(ss::intikey): 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?) ivs_3des: E80B3F0CD6566DD0 eid4_fallback_0x00(ss::fix1_it) FF1471C135E4593D0D27F9CAA3795BD9 //used for bd-it as kf1_eid eid4_fallback_0x10(ss::fix2_it) DD38369F0175173CE32BEED051FD4EF3 //used for bd-it as kf2_eid
eid4_fallback keys added from this source
trivia(you can find these in the middle of the keys) http://pastebin.com/mWxb3Zxj
ivs_3des also exists in lv2_kernel, as well as ivs_aes
M1m. AES128 key: 27CBB8C5EF730EE48DB2771AAC2584D5 M1m. HMAC-SHA1 key: D3865918B43AE81891ECEC337B74A8C38F1F1F45 M1m. RSA exponent: 00010001 M1m. RSA sig pub: ABEFDE4DF9FE8D926314C9EB0E08FF27C7FE9E64B1D0263410614E9361403BDE6F2F192823432F731F02E62B1888D6885418FBB2D992AF2ED5D5C9D868A19482 E9A9C888746D05CFC60431F913D64B8D29B4A06D31F8EFF35AAA2B530C9E937974699C1BF1BA011F7E400188EC984B534AFCF6BFC9123AEC4951BFDC5FB76367 C40BF45E03B73F0621D45B49C13F84AB457F837AC2F479654926F0D5DFD48CD717C1DF3DFBABB2ED4D1C9F21AE3BAF30979022F94518AE99E1697F87CEFFFB68 473D1D5EBDCC1F4D377702DD549F066E3FE8991C3FAF4FA9AD5E1BAA428968D72FA89E644B75A71A66E5E92EB7D1E5B8D6ED60FE1BDEAC422BCB2189917FBD5B M1m. RSA sig priv: 021CA7296409B96973E81C76D3AC4E9E0979DA2E3874EB1336A44B57CA1904E33D906189B9AD28970C6977B44DCFD87AC235B059C90C61347D11EC31C94F3AC8 C4DFFE03971283C0C298E8983BA325386DABB750C00D63BD247EF49B478B671A55D0BA472997F44D93BA6B8A680592DF4A0B836865AAE0A8685A25B62A42D168 BEBB41A64B4F5AE5FA11139011AC8FC3493E67A7395A0A3FD8BA27DD61DBD1FB35E78DB5DCAC5777996E6300C28E94FCA738F76C1E64426CE4383EEA584F0E7D D70DF2285932646D998F32B12C04EEEF9749AA3863D6D7F793A57C77EA3DB63FBFD0D610E2E0131252EB2BA05683154BCE8EBC499F33D7FFA2C11C9EC0030EA1 M1m. RSA sig P: D33C8EA25BA8282A3112E144D513E7699A61515D2095174A9F01D16742A194BD77403BBF88B2768183A1F285A1941246E073CFB0FAC3A98E143EB4D62A653DD6 09228D0DA3241DA7ACF8F1D1DA0C13BBC0203B28C25C1C97C179A256ABE585031472F2141BFF6A74F735AE43DB86AB67A2496CBC2E79F7E9972391BCE7FECC6B M1m. RSA sig Q: D05F55F9AE87DE25BAFEA72177E531D11705BDD75A198C1E2B9348EBAE4EAFE6C803D4048742F86298D3E5CE1E09634724F22481E8E668DA9F54688EE8880A90 292ED95DB63F2E7D284A77F694EF810005E70D79FD68E2CC14E56435C9A40D576CC0AEA0A945EA78EAEB867155F56CEA88BDC32B82B60D3CAC95F3B305270ED1 M1m. RSA sig DP: 3FA9F8B3263CC01E373C2178C55F82576997FB15BE443108E4737FD1475BBBA07ED875297CE18CA5EC2E5B11BB690D391F5CC833E6E021B21897ED98BE9E54CC B5641C6F07C452CBBE6E2933BE2BF5A698791E5B6278B0856C6264730ACBDA12DB8EE936F6593C94940D31C071E15CB79749D9E3BD7E3521C9D3869110BAD291 M1m. RSA sig DQ: 5194219AE123BC6B552C81CE6E9C42C6B396C1DE601E04678373E466B115897476F658B97523590F70F9F4CC9FA1D9466F4685D87E904698E12C30CB526A8088 34376D4E6D1D8B5BE0BC56FF290C239B18B47EE835B82CA2EDC3695A4D9976C7B582325C20298944D1E467FC534504E145ABD58F615B590F5A1A5310D1819B21 M1m. RSA sig QP: 7FF06086CF3008E29BB3F17AF378D2FEDA69DE90810D22A902B9F2FED95C43D3D09A5A80F91036319E7369BA656CD3F9A84A9CF3D8A7EF655F8D2D0D9BAA294C 7614F34CA229171E12C9FCC2F197C8A6C7CE606B82A9A2304C8335426F4F74F8084FBAABD0D30B5B83D9396BB7578CEFF740C200602A820E94F9A893F9B2F826 M1m. RSA cryptkey: B107EBE57C7A3D72F2FB11D292982C3ED522763BC85A028A7692E70FCE057D67F629FCFE267E36AEEDB3FAFB3501524CECAD9220156B55ABF702BA431B6C7BF3 6FD47E02904833B632BB1AB7DCB0CE65CFAE7B76A3E9990703CD0B80AFDF86FA0FB7959D99D251064EC39A9B85303C8BBC79DC8C96293EE8C4354C5E4AB795A4 F32348691C0D6163266F780B09D08ACA502C9E2A0ADDDA7B9C35DDC820B547783FB665C6721ABC10589A680A95DCAC6B9CBE45B2AFC76D6B1119C55C3A9591DD 1589DCCB352535C44409B26CD3B3330F5D162D0FEA489C5C7A3726F7AD46090B2132B130326610C24C751CA93FBB6DD8862249116BB6794F105D72E705C2361D NPpp aes key: 4867B35FB38774F665EB96E76F4D1665
PS3 ?4.86?:
uint8_t nppp_hmac_key[0x40] = {0x4E,0x43,0xBC,0x2C,0xAE,0xF6,0xF0,0xC3,0xE3,0xFB,0x4F,0xFA,0x8C,0x34,0x52,0x21,0x28,0xE3,0x6D,0x83,0xE7,0xEC,0x10,0xF8,0x23,0x86,0x2F,0x64,0x7A,0xB0,0xB5,0x88,0xA0,0xD8,0xAA,0x50,0xA9,0x6E,0x9E,0xD1,0xEB,0xA9,0x10,0xC0,0x7C,0x87,0x6F,0x5D,0x57,0x9C,0xC2,0xE7,0x06,0x48,0xBC,0xAE,0x98,0xD7,0x19,0xDB,0xD2,0x6C,0x2A,0x39};
uint8_t nppp_aes128cbc_key[0x10] = {0x48,0x67,0xB3,0x5F,0xB3,0x87,0x74,0xF6,0x65,0xEB,0x96,0xE7,0x6F,0x4D,0x16,0x65};
uint8_t nppp_aes128cbc_iv[0x10] = {0};
spu_token_processor
095.001 - 3.56: token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A token-key: 341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED token-iv: E8663A69CD1A5C454A761E728C7C254E 3.60-4.91: token-public: A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404 token-curve-type: 0x9
08x - ??? SD
token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B
token-key internal: 8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA
token-iv internal: FEA685F720B0C60A65DC97B8B2C8BCB3
spu_utoken_processor 3.55
utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA utoken-erk: D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736 utoken-iv: A6523E5426470953FE8C90F61BCA927A
sc_iso
secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA # 060.013.r010 - 4.91 secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765 # 060.013.r010 - 4.91 secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59 # 060.013.r010 - 1.70 sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7 sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2 sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22 sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654 sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B sc_key::key_for_master : 73636B65795F666F725F6D6173746572 sc_key::series_key : 73636B65795F7365726965736B657900 sc_key::series_key2 : 73636B65795F7365726965736B657932
service mode dongle HMAC
46DCEAD317FE45D80923EB97E4956410D4CDB2C2
PUP HMAC
F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366
- Location: software update plugin
DAT
dat-iv: 3032ADFCDE09CFBFF0A3B3525B097FAF dat-key: 2B7E151628AED2A6ABF7158809CF4F3C
EDAT
edat-cypher-key-0: BE959CA8308DEFA2E5E180C63712A9AE edat-cypher-key-1: 4CA9C14B01C95309969BEC68AA0BC081 edat-hasher-key-0: EFFE5BD1652EEBC11918CF7C04D4F011 edat-hasher-key-1: 3D92699B705B073854D8FCC6C7672747
SDAT
sdat-key: 0D655EF8E674A98AB8505CFA7D012933 (SHA1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)
- Location: lv2_kernel
PS3 Minis ISO.BIN.EDAT
How are these keys used? What is the link with PSP klicensee?
ps3minis1: D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570) ps3minis2: 625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)
aim_spu_module Keys
Observations
Warning: this section should be refactored as names here are from 2011 libeeid code and RE and are outdated because at the time their use was misinterpreted. See zecoxao's ps3-decrypt-tools for updated key names.
Ks stands for keyset but was misinterpreted:
aim_ks_1 : 2ED7CE8D1D55454585BF6A3281CD03AF <- EID0 section 0 seed aim_ks_4 : 30B0395DC5835AAA3A7986B44AFAE684 <- EID0 section 0xA seed
Some keys have yet to be studied:
aim_iv : 51F78B72A64711CF5C72323FB8607A00 <- magic_iv0 <- ???? aim_key : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 <- magic_key0 <- ???? aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)
aim_compare->magic_0 (note that there is magic_1 and magic_2 also in very old PS3 firmwares)
aim_spu_module.self.elf 1.00: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00008670 40 1C 4A A6 3B 2C 8D 44 E2 45 F0 74 DA E7 78 2A @.J¦;,.DâEðtÚçx* <- compare (1.00-3.42) 00008680 36 0D 1E 8E E2 11 6B DF 6F 0D 8A 3C C1 7B E3 8F 6..Žâ.kßo.Š<Á{ã. <- compare (1.00-3.42) 00008690 EA 48 B5 71 F4 D2 6D ED 00 00 00 00 00 00 00 00 êHµqôÒmí........ <- compare (1.00-3.42) 000086A0 51 F7 8B 72 A6 47 11 CF 5C 72 32 3F B8 60 7A 00 Q÷‹r¦G.Ï\r2?¸`z. <- IV (1.00-3.42 but not found in 3.50++) 000086B0 92 2B 19 8C DF 0C 07 DC CE 84 8B 69 88 2D 80 4C ’+.Œß..Ü΄‹iˆ-€L <- KEY (1.00-3.42 but not found in 3.50++) 000086C0 C2 3F 19 C2 EA E1 24 4F 35 AF 17 6F 7F D3 78 51 Â?.Âêá$O5¯.o.ÓxQ <- KEY (1.00-3.42 but not found in 3.50++) 000086D0 2E D7 CE 8D 1D 55 45 45 85 BF 6A 32 81 CD 03 AF .×Î..UEE…¿j2.Í.¯ <- KS 1 (1.00-3.56) 000086E0 30 B0 39 5D C5 83 5A AA 3A 79 86 B4 4A FA E6 84 0°9]ŃZª:y†´Júæ„ <- KS 4 (1.00-3.56)
aim_spu_module.self.elf 3.42: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00003070 30 B0 39 5D C5 83 5A AA 3A 79 86 B4 4A FA E6 84 0°9]ŃZª:y†´Júæ„ <- KS 4 (1.00-3.56) 00003080 2E D7 CE 8D 1D 55 45 45 85 BF 6A 32 81 CD 03 AF .×Î..UEE…¿j2.Í.¯ <- KS 1 (1.00-3.56) 00003090 92 2B 19 8C DF 0C 07 DC CE 84 8B 69 88 2D 80 4C ’+.Œß..Ü΄‹iˆ-€L <- KEY (1.00-3.42 but not found in 3.50++) 000030A0 C2 3F 19 C2 EA E1 24 4F 35 AF 17 6F 7F D3 78 51 Â?.Âêá$O5¯.o.ÓxQ <- KEY (1.00-3.42 but not found in 3.50++) 000030B0 51 F7 8B 72 A6 47 11 CF 5C 72 32 3F B8 60 7A 00 Q÷‹r¦G.Ï\r2?¸`z. <- IV (1.00-3.42 but not found in 3.50++) 000030C0 40 1C 4A A6 3B 2C 8D 44 E2 45 F0 74 DA E7 78 2A @.J¦;,.DâEðtÚçx* <- compare (1.00-3.42) 000030D0 36 0D 1E 8E E2 11 6B DF 6F 0D 8A 3C C1 7B E3 8F 6..Žâ.kßo.Š<Á{ã. <- compare (1.00-3.42) 000030E0 EA 48 B5 71 F4 D2 6D ED 00 00 00 00 00 00 00 00 êHµqôÒmí........ <- compare (1.00-3.42)
mode_auth_data
This is Product Mode authentication data, stored in Syscon EEPROM.
key : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF iv : 0123456789ABCDEFFEDCBA9876543210 hmac_key : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037 F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872 magic : 52796F7461726F206973206375746521 (Ryotaro is cute!)
SYSCON_MANAGER_KEY
D413B89663E1FE9F75143D3BB4565274
AACS Keys
aes256ctr_key: 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96 aes256ctr iv: 802794556C7716719B40A175DB9A455E
[Another decrypted arrays with this key]
magic: FolkloreJam
key: 2DC2DF39420321D0CEF1FE2374029D95 iv: 0BA0F8DDFEA61FB3D8DF9F566A050F78
new magic: CODEFACE
public key 1 enc:
453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2
public key 1 dec:
63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27
public key 2 enc:
5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122
public key 2 dec:
784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7
public key 3 enc:
26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5
public key 3 dec:
00000000000000000000000000000000000000000000000000000000000000000000000000000000
private key enc:
05974EA73D2019A1FE03A7F685DCBD5A7D2F07E5BF15DA291B31586C8840C75B
private key dec:
004FC12D7464FBFB3E0D5754016AE6867A256C16EA
Curve:
p = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF a = 9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC b = 402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8 N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017 Gx = 2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6 Gy = 0914A25DD05442889DB455C7F23C9A0707F5CBB9
Second aes-256-ctr_key:
6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384
Second aes-256-ctr iv:
BC0D7738D332B780A6F89ED022745F0A
CPRM
Decryption key for obfuscated arrays:
Key: 688D8FECC3AAB50AAE45506B41A48BC3 IV: 6AC5B2F7055C031AE36BA31D285D24E5
Decrypted array 1:
3AD09AB6F5C116B758F6EDE6D98C57FC FD4B9B470E8EFFF3BBBA0A8015D72B36 6A435A89B45D71198FA088B8E88AC3AE 7C4E3DB596CC21001A6B12DB1FE4119D D39368B07F3B52B994DDA51B466031EC C9F8E95E1398BF27560891E36F2040B2 2CCE0210E018D56CDECD8779AFA92650 F233926EC03F3941AA5B7D2403D62FEB 0B99864C51458D2EEF077BE24D7AFE25 5C29A2A8B1F0B3C4307E6338CBF44FD1 DF4432DC175F662A819E774A656734FA 541E14BE04F1A79C8B37EE85AB220F69 C5D40584A47342A164E1708390C2480D 611CC672FB7674E701D8C8D275A3CF28 821D4935C7BDCAA6AC0C62ADF93CEA2D 59DA3E976D09F755E523539F06BC9578
Decrypted array 2:
009153EE3EC7524B0000000000000000
AV CC Multi
942C152C1C2C9D2C94AE15AE1CAE9DAE
Archive keys
FA72CEEF59B4D2989F111913287F51C7 generic key
EA02CEEF5BB4D2998F611910D77F51C6 per-console key
Marlin DRM
DES key/iv? 7563686979616D61
KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443
DivX DRM
Key 0678CE0EC45DA9554D2CDA549B91BC1C37D628FBDAB2B095649D4E102A1D1B41
Arcade Master Key
Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F IV 929214D8FCCB4CE7099ACEBDFC6612B9
- used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds
- Location: Lv1Ldr
Arcade ATA Decryption Key
Key: 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A IV: 00000000000000000000000000000000
- algo is aes-192-cbc, used for System 357A (GECR-1100)
- Key forged by encrypting Arcade ATA Seeds with Master Key
Arcade ATA VFLASH Decryption Key
Key: 5F20A21ED12FF6425B62FDE0D1881C84 IV: 00000000000000000000000000000000
- aes-128-cbc
- Used for System 357A (GECR-1100) VFlash.
- Key forged by encrypting Arcade ATA Seeds with Master Key.
Arcade ATA Decryption Key 2
Key 5F20A21ED12FF6425B62FDE0D1881C845F20A21ED12FF6425B62FDE0D1881C84
- Key used for System 369
Arcade EncDec Decryption Key
Key 7B07E0D651130EB443146836DB89B5AB230976E1E842D4F44A5E257615991BA1
- Used for System 369 (VFlash).
SCEI_AD_SIGN AES CBC Master Keys
RIV0: 8ceb482d10befb61871b6407dcfce7a3 KEY0: 3683a2fae5e62fc59004db1911c0562f RIV1: 08080b7163e4fbabc2905023d430fc92 KEY1: c4b92b1e1fc6429ae63701340336a529
- Location: lv2_kernel.self
- Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel.
- Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside?
- See code.
SCEI_AD_SIGN RSA Keys (External)
pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61 exponent : 010001 priv : 045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361 p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3 q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1 invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3
- Location: lv2_kernel.self
- Used for popup ads
SCEI_AD_SIGN RSA Keys (Internal)
pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF exponent : 010001 priv : 03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49 p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9 q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67 dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9 dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE
- Location: lv2_kernel.self
- Used for popup ads.
Trophy RSA Keys
pub : CA30CEE59BF19E041F6F02C54AE42CD6769185E157AB8659B70DCEC0C3EE6039FF952FD9767D35474B11BB5514205C553864F77BD4DA899B30110B0EA4F8AD33FBE0350E085B2A92A7D327978110AAB95085730235408156707C3B2238F978BFF4F308063809AEAFB2F9AEC62E1968CFF58B9BA834B3588C92C8411C548BFC49 exponent : 010001 trns_pub : CE8A7F561F08EC50EAD12C1CD5EA95F914574E52942E1D25D944319704ADC3E87FDE0E0451EDA05C347BBA584E7572F9660D18014E444C46C8EE8ADF10F4A1345FE51EF42D94A1A9DE692CE99702AAC4D4C5E528EFADBA5B53B20A50B686D084307EC3EABB61157E5E00A96A374FBF5C570B804D821C17573C1C00ACF29CF5E7 SceNpTrophyXmlShaHmacKey : 6AC0B3FB1EBB4FB7BCC2A00DA3A2A4BDBCB788EC456748CC86CD9D09EF37937F6EE31167778E414E9B711BE9D8CBB5F8956E454EE94A46C39DC4FF0D090B92B7
- Location: np_trophy_util.sprx
CFK1 Master Keys
INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8 INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185 NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c
- Location: lv2_kernel.self
- Added in 3.10. Seems to be Cinavia related?
PME Vectors
reset external decrem syscall 482D2D34 482A4F70 482A509C 482A50E4 <- internal 48202658 482023D0 482024FC 48202544 <- external 48079C94 4806E624 4806E750 4806E798 <- mambo_internal
- these denote the location of several things inside lv1. TOC is in the third entry
SYSCON Keys
- Note: The SYSCON Slot Keys are all used on later models of SherWood up until 0x1D slot
- The other keys are also used, available on the arm firmware
- The only difference is in the generation of the patch keys
78K0R ID
3A 4E 6F 74 3A 55 73 65 64 3A
- :Not:Used:
GARBAGE Key
C8979F5726F6A130CB9309A2F7AA0C84
- Used in conjunction with factory init key.
- Encrypt 16 FFs with this key for n times, where n is offset of EEPROM / 16.
- exists on slims!
EID1 Keys
0x0 Master Key
A46BA2B83D4E7EE559F239E0087A3808
- Decrypts magic value at EEPROM offset 0, or at 0x70000 on AA rom, or at 0xB0000 on BB/CC rom (size 0x10) which is SC INITIALIZATION STATUS, where 01 means UNINITIALIZED and 02 means INITIALIZED.
- This crypto is also valid for PS3 SLIMs SW2 !
0x10 Master Key
5794BC8C2131B1E3E7EC61EF14C32EB5
- AES128CMAC key to sign EID1 from 0 to 0x280.
- Resulting CMAC digest is compared to the one in EID1 at offset 0x290.
- AES128CBC key to decrypt EID1 second flash layer.
- 0x160 bytes of keys and a padding of zeroes present inside decrypted EID1.
- This crypto is also valid for PS3 SLIMs SW2 !
0x20 Master Key
88228B0F92C4C36AF097F1FE948D27CE
- AES128CMAC key to sign EID1 from 0x10 to 0x290 (the area covered in BB chip is 0xB0010 to 0xB0290 but CMAC mismatch).
- Resulting CMAC digest is compared to the one in EID1 at offset 0x2A0.
- AES128CBC key to decrypt EID1 EEPROM layer.
- 0x160 bytes of keys and a padding of zeroes present inside decrypted EID1.
- This crypto is also valid for PS3 SLIMs SW2 !
- On slims, AUTH1 seeds from sessions 1 to 6 are missing inside BB/CC chip data
0x40 Master Key
48FF6BFA9C172C6E14AE444419CAF676
- Used to obtain data at EID1 offsets 0x2A0, 0x2B0, 0x2C0, 0x2D0 if keyseed at decrypted EID1 offset 0 is encrypted, once, twice, three or four times, depending on the offset count + 0x10 starting from EID1 offset 0x2A0.
- Also used to obtain data at 0x2E0, 0x300, 0x320, 0x340 (if data at EID1 offset 0x2A0 is 00...01, use encrypted keyseed once).
- CMAC data at 0x2E0 with key encrypted once and if it matches with data at 0x2F0 decrypt, same with 0x300/0x310, 0x320/0x330, 0x340/0x350.
- This crypto is also valid for PS3 SLIMs SW2 !
SNVS Keys
0x30 Master Key
A09631B4F8AFC77780CB6C9EEB0870FC
- Used to decrypt SNVS.
- Encrypt keyseed at EID1 offset 0x150 once for section 0, twice for 1, etc, up to 8 times for section 7.
- Decrypted regions are with initial byte xored with 0x00 for first 0x10 bytes, 0x01 for second 0x10 bytes, etc, until 0x40 times per section, for a maximum counter of 0x3F.
- This crypto is also valid for PS3 SLIMs SW2 !
AUTH Keys
0x110 Master Key
A3ADB99A21E47ADFF3FD7FC3173981CA
- BE_SC
- This crypto is also valid for PS3 SLIMs SW2 !
0x120 Master Key
6933CEE7A518E5B8CBE1FC14B261B765
- SC_BE
- This crypto is also valid for PS3 SLIMs SW2 !
0x130 Master Key
1762C80CA86683B7E76FE3853CCFE5DB
- XOR with 2 keys to obtain SC2TB and TB2SC Keys.
- This crypto is also valid for PS3 SLIMs SW2 !
Fixed Auth1 Response
3350BD7820345C29056A223BA220B323
- 0x45B8
- exists on slims!
Fixed Auth2 Response
3C4689E97EDF5A86C6F174888D6085CF
- 0x45C8
- exists on slims!
SC2TB Key
71F03F184C01C5EBC3F6A22A42BA9525
- (0x130 xor 0x4578)
TB2SC Key
907E730F4D4E0A0B7B75F030EB1D9D36
- (0x130 xor 0x4588)
secure_com_lib_internal_key::session_key_create_key
9F1DF816BB4A4A0129D031CFB0AD9B30 0x50 Master Key D302FDE17578FBDBA1058449BA5C1BEA 0x60 Master Key 0E6B7480E5CEB2562A3347BB41012455 0x70 Master Key 7910AC5D2AD16001F6A2783979096103 0x80 Master Key E3052804B7D2836F2879A1751BB40D48 0x90 Master Key EF586F9D599170676850590BA67D4BC7 0xA0 Master Key 5D9598637AF25F8023623B1268B5131A 0xB0 Master Key 0EAA32140A2861D8659626F6CE2286DB 0xC0 Master Key
- This crypto is also valid for PS3 SLIMs SW2 !
AUTH1 Related Key
C50A57BEC9F2A2EE1C4478526EE24B88
- 45A8
- exists on slims!
AUTH2 Related Key
2B1072970A7576D8E59803977FF2E459
- 4598
- exists on slims! twice!
TIME Key
secure_com_lib_internal_key::time_key
E3EFDE987E4A2D3F8CF7B3B60E846B21 0x00 0x110 seed with 0xD0 keyvault key 4AB026664E9D02F53EFF9544549B1F97 0x01 0x120 seed with 0xE0 keyvault key 7ECA7F299891F1B243119E35AE94C3DE 0x02 0x130 seed with 0xF0 keyvault key E0B7A0867CF44923BAE65E3386460C80 0x03 0x140 seed with 0x100 keyvault key
EPROM Keys
0x150 Master Key
8CD72FD3E1E537CB51D6F1FEEEB5CE4C
- used with master key 0x1D0
- used with master key 0x190
- used for rtc clock correction
- exists on slims !
0x160 Master Key
DED8B76BF948E396BDCF74F1DE1C64E4
- encrypts 0x2710
- exists on slims !
0x170 Master Key
7AB230EAD7DD151695878AEBB20812BC
- encrypts 0x2760
- exists on slims!
0x180 Master Key
210623DCA298994DFE87F840FC481CBF
- encrypts 0x2790
- exists on slims!
0x190 Master Key
7073147F753089CC7256D37113032E3C
- decrypts 0x26B0, 0x26E0, 0x26F0
- exists on slims!
0x1A0 Master Key
A8DF3DBB4D0B526A0EAE3039C6A04F90
- decrypts 0x26C0
- exists on slims!
0x1B0 Master Key
259A8A939591C7D11CBA8682EEC7D50E
- decrypts 0x26D0
- exists on slims!
0x1D0 Master Key
179C503127A8E8F594437B1C108357A7
- decrypts 0x2700 / 0xB2700 on slims
- This crypto is also valid for PS3 SLIMs SW2 !
FULL Keys
CIPHER ENC
428D643E54C76BAED8428907B1952FC7
- exists on slims!
HASHER ENC
E6AF3DCEAA1F4185D344CBCEDCBC280F
- exists on slims!
MASTER
97DAAC1F9640F576A53ECE93C92B17F2
- exists on slims!
CIPHER KEY
160374F159B744C97F2CF2DD3EEE599D
HASHER KEY
3E0020AEF88FF50D693B6521E2A1C4F3
PTCH Keys
MASTER
5E7CD16A78443928120688D7883493F1
- exists on slims!
0x140 Master Key
0B3C10FF47FC9D3437CA80952CAE9170
- PTCH xor key
PTCH CIPHER XOR
D6DD7D29B4F55B318091821CF7C84A3C
- exists on slims!
PTCH HASHER XOR
1828374D624774AF0144535DE54FF10F
- exists on slims!
COK-001 body key
C1D5D39BBC56839E95AB842233FF1C59
COK-001 hasher key
FDFCE3EB57BAE13A39B127BB3226DA14
COK-002 body key
C9D03C410A120F66E4F4A96ADAF5ADAA
COK-002 hasher key
746D66511105D0DB54BF3EDFAD275EAC
SEM-001 body key
D484266DB6C3AE16B1B82DDBBBF99479
SEM-001 hasher key
7843E32BA18B34355436C2F657F41F16
DIA-001 body key
0121F8AB75898AD2C58D3546B7D8F72E
DIA-001 hasher key
310068E416324779C32C47D32B39CAB5
DIA-002/DEB-001 body key
6B3583DA1AA6B49106E1641178EE68C8
DIA-002 hasher key
6E9CE7C57BFC27CDD59A05093ADFE475
PROTO BOARD 1 body key
F790F953D734AC5D7C78EE498B98CE48
PROTO BOARD 1 hasher key
C5E30C6393A1EE315E3F9BCA4CF275B0
PROTO BOARD 2 body key
881AE6022FAEDDE0FABC01DFFABAE140
PROTO BOARD 2 hasher key
A40B57FB1BCB160F99F9F126B8477D1C
DYN-001 body key
C4AB610A03B98A9B9E52FEF972967523
DYN-001 hasher key
B80A6FE26686C4F119AD76901D431494
Modules
Notes
- In CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)
- With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms
- Likewise, the individual_info erk is 256 bit size, but only first half is used.
A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also: https://web.archive.org/web/20130425164335/http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf
- <= 3.55:
- Randomfail present, thus when private key is unknown: use scekrit ;
- No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)
- 3.56:
- Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [1] ;
- No obfuscation added to loaders yet
- =>3.60:
- fixed the randomfail since 3.56, thus scekrit is of no use ;
- Obfuscation of keytable was added since 3.60 see Key Scrambling, which used ch72 ringbuffer seed for deobfuscation.
- "dec" in ldr table refers to the deobfuscated key as used by crypto engine ;
- "enc" in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable
Lv0Ldr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
lv0ldr (Internal) | - ( SD ) | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
lv0ldr | 0.60+ | CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A |
F9205F46F6021697E670F13DFA726212 |
A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D |
001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3 |
0x33
|
lv0ldr | 030.001-050.013 ( CEB ) | B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222 |
B43661B9A79BAD9D8E2B046469CDA1E7 |
4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20 |
002CC736C7AD06D264E9AB663EB1F35F5DC159248C |
0x33
|
MetLdr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
metldr (Internal) |
- ( SD ) | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
metldr | - | C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B |
47EE7454E4774CC9B8960C7B59F4C14D |
C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019 |
00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670 |
0x20
|
Lv1ldr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
lv1ldr (Internal) |
SD 0.80 | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
lv1ldr (Internal) |
SD 0.80-3.31 | 014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 |
A17D6A522CB1B08F97DA8A82E97C12F7 |
72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 |
008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8 |
0x11
|
lv1ldr | 030.001-3.31 | B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222 |
B43661B9A79BAD9D8E2B046469CDA1E7 |
4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20 |
002CC736C7AD06D264E9AB663EB1F35F5DC159248C |
0x33
|
lv1ldr | 3.40-3.42 | B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646 |
A79B05D4E37B8117A95E6E7C14FB640E |
7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375 |
00033A699FDD2DA6CDD6CCC03B2C6145F998706F74 |
0x34
|
lv1ldr | 3.50 | 1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7 |
E034D31A80316960024D1B3D3164FDC3 |
7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398 |
005815D17125D04C33790321DE29EB6241365100B5 |
0x35
|
lv1ldr | 3.55 | 53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23 |
44E652661AC7584DBE08ECB810FB5FC0 |
733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9 |
004312C65347ACBE95CC306442FEFD0AF4C2935EB3 |
0x05
|
lv1ldr | 3.56 | 48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83 |
15DCF3C67147A45D09DE7521EECA07A1 |
85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C |
- | 0x07
|
lv1ldr | 3.60-3.61 | 5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5 |
DF0F50EC3C4743C5B17839D7B49F24A4 |
1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E |
- | 0x05
|
lv1ldr | 3.65-3.66 | BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951 |
569AF3745E1E02E3E288273CDE244CD8 |
21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C |
- | 0x07
|
lv1ldr | 3.70-3.74 | 41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE |
C8C98D5A5CE23AF5607A352AECACB0DC |
4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667 |
- | 0x12
|
lv1ldr | 4.00-4.11 | 557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74 |
7144D7574937818517826227EF4AC0B4 |
085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96 |
- | 0x13
|
lv1ldr | 4.20-4.91 | 10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD |
ED8699562C6AC65204FA166257E7FCF4 |
9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2 |
- | 0x14
|
Lv2Ldr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
lv2ldr (Internal) |
SD 0.80-3.31 | 014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 |
A17D6A522CB1B08F97DA8A82E97C12F7 |
72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 |
008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8 |
0x11
|
lv2ldr | 030.001-3.31 | 94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F |
9769BFD187B90990AE5FEA4E110B9CF5 |
AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D |
0070ABF9361B02291829D479F56AB248203CD3EB46 |
0x20
|
lv2ldr | 3.40-3.42 | 575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10 |
411CB18F460CE50CAF2C426D8F0D93C8 |
3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA |
0073076441A08CD179E5FACE349B86DA58B5B7BA78 |
0x21
|
lv2ldr | 3.50 | 6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68 |
603A36213708520ED5D745DEC1325BA5 |
5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3 |
0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD |
0x22
|
lv2ldr | 3.55 | 84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17 |
5B240444D645F2038118F97FD5A145D5 |
B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72 |
009D4CBA2BFB1A8330D3E20E59D281D476D231C73A |
0x32
|
lv2ldr | 3.56 | EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359 |
9CA9282DC7FA9F315EF3156D970B7CD4 |
0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699 |
- | 0x33
|
lv2ldr | 3.60-3.61 | 88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC |
8D18E8E525230E63DE10291C9DD615BF |
86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027 |
- | 0x32
|
lv2ldr | 3.65-3.66 | 688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0 |
75E0239D18B0B669EAE650972F99726B |
008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA |
- | 0x33
|
lv2ldr | 3.70-3.74 | E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254 |
15058FA7F2CAD7C528B5F605F6444EB0 |
438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED |
- | 0x11
|
lv2ldr | 4.00-4.11 | A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97 |
BBE7799B9A37CB272E386618FDFD4AEC |
5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8 |
- | 0x07
|
lv2ldr | 4.20-4.91 | 0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03 |
9B79374722AD888EB6A35A2DF25A8B3E |
1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50 |
- | 0x14
|
IsoLdr
Module | Version | Revision | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|---|
isoldr (Internal) |
SD 0.80-3.31 | 0x01 | 9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9 |
2C1F4C82FF3A796D3A772CEEF010ECA4 |
625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782 |
00D19A1B338041F7C31062B9C40E725E1DA5D7C11A |
0x20
|
isoldr | 0.60-3.31 | 0x01 | 8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4 |
C82D015D46CF152F1DD0C16F18B5B1E5 |
733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29 |
009BE892E122A5C943C1BB7403A67318AA9E1B286F |
0x36
|
isoldr | 3.40-3.42 | 0x01 | 101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D |
8D2E9C6297B8AD252998458296AC773C |
138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625 |
00849DBC57D3B92F01864E6E82EB4EF0EF6311E122 |
0x32
|
isoldr | 3.50 | 0x01 | 3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843 |
A414AC1DB7987E43777651B330B899E1 |
1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F |
0085B4B05DEBA7E6AD831653C974D95149803BB272 |
0x33
|
isoldr | 3.55 | 0x01 | BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37 |
0207A479B1574F8E7F697528F05D5435 |
917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58 |
00294411363290975BA551336D3965D88AF029A17B |
0x03
|
isoldr | 3.56 | 0x01 | 311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE |
7BB8B3F5AC8E0890E3148AE5688C7350 |
3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD |
- | 0x08
|
isoldr | 3.60-3.61 | 0x01 | 8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093 |
FFF9CACCC4129125CAFB240F419E5F39 |
098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556 |
- | 0x03
|
isoldr | 3.65-3.66 | 0x01 | E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592 |
D292A7BD57C0BB2EABBCA1252FA9EDEF |
2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5 |
- | 0x08
|
isoldr | 3.70-3.74 | 0x01 | 072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51 |
8516A81F02CF938740498A406C880871 |
5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D |
- | 0x21
|
isoldr | 3.70-3.74 | 0x0100 | 786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8 |
94662F13D99A9F5D211C979FFDF65FE3 |
912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B |
- | 0x0E
|
isoldr | 4.00-4.11 | 0x01 | 4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD |
4F1E3EF07D893A4714B1B3D5A4E50479 |
4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702 |
- | 0x11
|
isoldr | 4.00-4.11 | 0x0100 | 16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B |
0E50DB6D937D262CB0499136852FCB80 |
AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC |
- | 0x0F
|
isoldr | 4.20-4.91 | 0x01 | 63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086 |
953F6A99891B4739358F5363A00C08B9 |
26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612 |
- | 0x15
|
isoldr | 4.20-4.91 | 0x0100 | B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C |
B96EA32CB96EA32DB96EA32DB96EA32C |
2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151 |
- | 0x02
|
Spp verifier
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
spp_verifier (Internal) |
- SD | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
spp_verifier | 0.80-3.55 | 56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A |
007E6B268EF1E986D10A9889CF93A8CB |
265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A |
0001608EF3BACAFFB8C3A5958A24F758325B62B08C |
0x22
|
spp_verifier | 3.56 | 7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0 |
B889290922B002F57086B818A8FDE3CC |
71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63 |
- | 0x22
|
spp_verifier | 3.60-3.61 | ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2 |
3E05572881C5BC845D310EAC28497B08 |
504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E |
- | 0x13
|
spp_verifier | 3.65-3.66 | E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4 |
0F23BBED0473B4899AD793AC76D8F722 |
934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F |
- | 0x22
|
spp_verifier | 3.70-3.74 | 4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0 |
3B6203C2730D283F978A12D5390DD747 |
0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8 |
- | 0x23
|
spp_verifier | 4.00-4.11 | 11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF |
67B49380C74FFB15AD929E8C819586AD |
5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3 |
- | 0x04
|
spp_verifier | 4.20-4.91 | D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5 |
6D308B59BC9054B12C833359D31BAE77 |
0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5 |
- | 0x07
|
RvkLdr
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
rvklist (Internal) |
- SD | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
rvklist | 030.001-3.55 | 03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF |
8B5D7876F40A9E1E9AC2B22F51B60BDF |
9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7 |
00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF |
0x29
|
rvklist | 3.56 | 22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE |
D5D4B8ED62B6CCA0249A79776E136975 |
51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B |
- | 0x32
|
rvklist | 3.60-3.61 | BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3 |
B20A23079516205525683D8058379CBF |
9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6 |
- | 0x33
|
rvklist | 3.65-3.66 | 1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C |
501819323BFCF9FB99396B46B70A97E7 |
6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448 |
- | 0x30
|
rvklist | 3.70-3.74 | 4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4 |
0E5CB28FA2666E3ED45289DABC67DDC2 |
758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371 |
- | 0x31
|
rvklist | 4.00-4.11 | 99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E |
182CC801794A2F7027BB76D29D598550 |
6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C |
- | 0x02
|
rvklist | 4.20-4.91 | 695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17 |
a8ba3e4e63b2bb06fc0ce57e3bb8fc46 |
7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a |
- | 0x12
|
Spu Pkg Rvk Verifier
Module | Version | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|
spu_pkg_rvk_verifier (Internal) |
- SD | FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF |
0123456789ABCDEFFEDCBA9876543210 |
123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872 |
000000000000000000000000000000000001000000 |
0x27
|
spu_pkg_rvk_verifier | 0.60-3.55 (pkg) | A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031 |
4ACEF01224FBEEDF8245F8FF10211E6E |
41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 |
00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 |
0x23
|
spu_pkg_rvk_verifier | 3.56-4.91 (spkg) | F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD |
59D28DB4ADDFB40B7D768BC9667C67B1 |
5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0 |
- | 0x17
|
Updater (CEB units Ebootroms)
Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated).
Module | Version | ERK | RIV |
---|---|---|---|
updater | E/rXXX | D9580C4D6349692159CDDFC33F53908B |
CB445249CE6A9FEB01DF02C7B94938E1
|
updater | I | 99817C618D61549DDDEA247E57788920 |
E5EA482810A63CF1D29347D3092E6B90
|
individual_info | E/rXXX | 987C95CC38C286D0E36252B867BCEBA1 |
1AAEBF3ED6EB1B295DAC75963DB37651
|
individual_info | I | D0BE92DE84F83A26DE1E670683066243 |
???
|
toolupdatedec (Communication Processor Updater binary)
Module | Target | Filename | ERK | RIV |
---|---|---|---|---|
toolupdatedec | TCP510/TCP520 | reftool_cp_xxx.bin | E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F |
File dependant (the first 16 bytes of the file)
|
toolupdatedec | DTP-T1000 | psptoolupdate.bin | A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB |
File dependant (the first 16 bytes of the file)
|
PS3 NIDs Salt
6759659904250490566427499489741A
Bluray Drive Keys
- These keys were retrieved from bluray drive firmware.
5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F 97EC3F4F8751F22B7FFCACA83803EAF7
or
E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7 5BCE24712335AF70E570F6559A29F34D
- Bluray drive firmware uses same curve as KIRK commands 0xC, 0xD, 0x10 and 0x11.
- Signature is at the bottom of the firmware (offset 0x7FD0).
- The algorithm is highly likely to be AES256CBC.
XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE
It can be used to decrypt emboot and another perdevice areas.
EID0 Sections Keys
Section 0
Public key: 94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A
Curve:
A34D0C98B2A8DEA81E7C3FF0757C5B89 1B8523E1A34D0C98B2A8DEA81E7C3FF0 757C5B891B8523DE929F2B86E0F6525F FDC819D76D5F139A2F8A49B300A34D0C 98B2A8DEA81E7CEC7E21A8FF20DC9B8F AF755FD420216829E389548D397246E6 6DF2EC4B7C9B308B62B9CEFFA3F0071A 5C396F67FCE4A3A683
Curve sha1: 9035B33F58DFAEF389FD49187F93C4FC2D2DD268
- Source: sha1 in naehrwert's tweet (2013)
Section 6
Same ECDSA public key and curve as PSP section 1.
Public key: 06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE
Curve: type 2 (vsh)
Section 0xA
Same ECDSA public key and curve as PSP section 5.
Public key: 4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A
Curve: type 2 (vsh)
Appldr
selftype | version | revision | fw | type | ERK | RIV | PUBLIC | PRIVATE | CURVE_TYPE |
---|---|---|---|---|---|---|---|---|---|
app Internal SD | 0.60-0.84 | 0x00 | 0.60++ | dec | 014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 |
A17D6A522CB1B08F97DA8A82E97C12F7 |
72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573 |
008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8 |
0x11
|
seven SD | ? | 0x00 | ? | dec | BBDF2959EB4AAEF5882BE11FF033B77FF9FD55B1F30819D42154F6B069C14FEF |
241C0CC5A8591B50EF460EE3E50116C3 |
0E140FBAD23F1B236C6AD0623A7C2C6366AEDA66380860A9D727A56FD681F644EF22A7E07979A1BE |
0x33
| |
app | 0.60-0.84 | 0x00 | 0.60++ | dec | 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04 |
4A0955D946DB70D691A640BB7FAECC4C |
6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 |
006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4 |
0x21
|
app | 0.84-3.31 | 0x01 | 0.84++ | dec | 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB |
6F0F25E1C8C4B7AE70DF968B04521DDA |
94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526 |
003DE80167D2F0E9D30F2145144A558D1174F5410C |
0x11
|
seven | 0.84-3.31 | 0x00 | =>0.84 <=3.31 | dec | D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085 |
DC01280A6E46BC674B81A7E8801EBE6E |
A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4 |
0x11
| |
npdrm | 0.85-2.36 | 0x00 np | 0.85++ | dec | 8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86 |
7AAECC60AD12AED90C348D8C11D2BED5 |
05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440 |
|
0x0A
|
app | 0.90-2.36 | 0x02 | 0.90++ | dec | 4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A |
90C127A9B43BA9D8E89FE6529E25206F |
8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E |
00530446451C568968EBF7068B1F45C252D70EC942 |
0x13
|
npdrm | 0.91-2.36 | 0x01 np | 0.91++ | dec | F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B |
A551CCB4A42C37A734A2B4F9657D5540 |
B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF |
00040AB47509BED04BD96521AD1B365B86BF620A98 |
0x11
|
app | 2.40-3.31 | 0x03 | 2.40++ | dec | C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E |
E0908163F457576440466ACAA443AE7C |
50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92 |
|
0x0B
|
npdrm | 2.40-3.31 | 0x03 np | 2.40++ | dec | 1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664 |
E31E206FBB8AEA27FAB0D9A2FFB6B62F |
3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D |
|
0x08
|
app | 3.40-3.42 | 0x04 | 3.40++ | dec | 838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA |
7FDBB2E924D182BB0D69844ADC4ECA5B |
1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69 |
0074E922FDEE5DC4CDF22FC8D7986477F813400860 |
0x14
|
app | 3.40-3.42 | 0x05 | 3.40++ | dec | C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC |
15D3F191295C94B09B71EBDE088A187A |
B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7 |
|
0x15
|
app | 3.40-3.42 | 0x06 | 3.40++ | dec | 6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41 |
24BD1C19D2A8286B8ACE39E4A37801C2 |
71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95 |
|
0x2C
|
seven | 3.40-3.42 | 0x00 | =>3.40 <=3.42 | dec | B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E |
86F56F9E5DE513894874B8BA253334B1 |
B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5 |
|
0x12
|
npdrm | 3.40-3.42 | 0x04 np | 3.40++ | dec | BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706 |
ADF7B207A15AC601110E61DDFC210AF6 |
9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30 |
00B61A91DF4AB6A9F142C326BA9592B5265DA88856 |
0x16
|
npdrm | 3.40-3.42 | 0x06 np | 3.40++ | dec | 8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020 |
05719DF1B1D0306C03910ADDCE4AF887 |
2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E |
|
0x29
|
app | 3.50 | 0x07 | 3.50++ | dec | 945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55 |
1D5EFBE7C5D34AD60F9FBC46A5977FCE |
AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD |
002CF896D35DB871D0E6A252E799876A70D043C23E |
0x15
|
app | 3.50 | 0x08 | 3.50++ | dec | 2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13 |
5A4CEFD5A9C3C093D0B9352376D19405 |
6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5 |
|
0x16
|
app | 3.50 | 0x09 | 3.50++ | dec | F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B |
F4D535069301EE888CC2A852DB654461 |
1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99 |
|
0x2D
|
seven | 3.50 | 0x00 | 3.50 only | dec | 8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6 |
908A75754E521EAC2F5A4889C6D7B72D |
91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B |
|
0x13
|
npdrm | 3.50 | 0x07 np | 3.50++ | dec | 3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3 |
E4897BE553AE025CDCBF2B15D1C9234E |
A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E |
009EF86907782A318D4CC3617EBACE2480E73A46F6 |
0x17
|
npdrm | 3.50 | 0x09 np | 3.50++ | dec | 0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A |
04AD3C2F122A3B35E804850CAD142C6D |
A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0 |
|
0x2A
|
app | 3.55 | 0x0A | 3.55+ | dec | 29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3 |
5D1FAB844107676ABCDFC25EAEBCB633 |
09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827 |
0010818ED8A666051C6198662C3D6DDE2CA4901DDC |
0x25
|
app | 3.55-? | 0x0B | 3.55++ | dec | A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3 |
E4792F2B9DB30CB8D1596077A13FB3B5 |
2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF |
|
0x26
|
app | 3.55-? | 0x0C | 3.55++ | dec | 9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA |
D43B1FA8BE15714B3078C23908BB2BCA |
7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB |
|
0x3D
|
seven | 3.55 | 0x00 | 3.55 only | dec | BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F |
263057225873F83940A65C8C926AC3E4 |
BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437 |
|
0x23
|
npdrm | 3.55 | 0x0A np | 3.55++ | dec | 03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4 |
0A99D4D4F8301A88052D714AD2FB565E |
3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B |
|
0x27
|
npdrm | 3.55-? | 0x0C np | 3.55++ | dec | 357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92 |
D26E6DD2B74CD78E866E742E5571B84F |
00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57 |
|
0x3A
|
app | 3.56-? | 0x0D | 3.56++ | dec | 03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194 |
5ADB9EAFE897B54CB1060D6885BE22CF |
71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142 |
- | 0x12
|
app | 3.56-? | 0x0E | 3.56++ | dec | 39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03 |
90266C98CBAA06C1BF145FF760EA1B45 |
84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255 |
|
0x27
|
app | 3.56-? | 0x0F | 3.56++ | dec | FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B |
64F50296CF8CF49CD7C643572887DA0B |
0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1 |
|
0x3A
|
seven | 3.56 | 0x00 | 3.56 only | dec | 71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B |
9DED878CB6BA07121C0F50E7B172A8BF |
387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3 |
|
0x29
|
npdrm | 3.56 | 0x0D np | 3.56++ | dec | 337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957 |
8405C88E042280DBD794EC7E22B74002 |
9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1 |
|
0x18
|
npdrm | 3.56 | 0x0F np | 3.56++ | dec | 135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291 |
4070C898C2EAAD1634A288AA547A35A8 |
BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433 |
|
0x3B
|
app | 3.60-3.61 | 0x10 | 3.60++ | dec | A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F |
7A203D5112F799979DF0E1B8B5B52AA4 |
50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934 |
|
0x25
|
npdrm | 3.60-3.61 | 0x10 np | 3.60++ | dec | 4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61 |
C0F2AB86E6E0457552DB50D7219371C5 |
64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213 |
|
0x27
|
app | 3.60-3.61 | 0x11 | 3.60++ | dec | 0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD |
97AF39C383E7EF1C98FA447C597EA8FE |
2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D |
|
0x26
|
seven | 3.60-3.61 | 0x00 | =>3.60 <=3.61 | dec | F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195 |
D3A7C3C91CBA014FCBCA6D5570DE13FF |
97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28 |
|
0x23
|
app | 3.60-3.61 | 0x12 | =>3.60 <=4.11 | dec | D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715 |
25589F01B97B9BE1E07447A3CE7F06B9 |
3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B |
|
0x3D
|
npdrm | 3.60-3.61 | 0x12 np | =>3.60 <=4.11 | dec | D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374 |
211B52440AB7066A53121106FEB29FD5 |
EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C |
|
0x3A
|
npdrm | 3.65-3.66 | 0x13 np | 3.65++ | dec | 265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46 |
8DEA5FF959682A9B98B688CEA1EF4A1D |
9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8 |
|
0x18
|
app | 3.65-3.66 | 0x13 | 3.65++ | dec | DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94 |
CB5DD4BE8CF115FFB25801BC6086E729 |
B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917 |
|
0x12
|
app | 3.65-3.66 | 0x14 | 3.65++ | dec | 491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E |
F98843588FED8B0E62D7DDCB6F0CECF4 |
04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E |
|
0x27
|
seven | 3.65-3.66 | 0x00 | =>3.65 <=3.66 | dec | BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860 |
22C19C5522F7A782AFC547C2640F5BDE |
3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F |
|
0x29
|
app | 3.65-3.66 | 0x15 | =>3.65 <=4.11 | dec | 324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4 |
A37B2139FBCF62F6B41F796A594440C8 |
A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694 |
|
0x3A
|
npdrm | 3.65-3.66 | 0x15 np | =>3.65 <=4.11 | dec | 3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F |
ABF2DA36D993554FB060322DC51097F7 |
497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569 |
|
0x3B
|
app | 3.70-3.74 | 0x16 | 3.70++ | dec | A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C |
62773C70BD749269C0AFD1F12E73909E |
566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF |
|
0x30
|
npdrm | 3.70-3.74 | 0x16 np | 3.70++ | dec | 7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B |
4AD981431B98DFD39B6388EDAD742A8E |
62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1 |
|
0x25
|
app | 3.70-3.74 | 0x17 | 3.70++ | dec | 4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46 |
954A86C4629E116532304A740862EF85 |
3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666 |
|
0x08
|
seven | 3.70-3.74 | 0x00 | =>3.70 <=3.74 | dec | F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F |
FC5FA12CA3D2D336C4B8B425D679DA55 |
19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA |
|
0x15
|
app | 3.70-3.74 | 0x18 | =>3.70 <=4.11 | dec | 1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997 |
BF8D6B1887FA88E6D85C2EDB2FBEC147 |
64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494 |
|
0x11
|
npdrm | 3.70-3.74 | 0x18 np | =>3.70 <=4.11 | dec | 1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133 |
402666C76D795D228089810DDC128D14 |
ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A |
|
0x15
|
app | 4.00-4.11 | 0x19 | 4.00++ | dec | 3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297 |
6153DEE781B8ADDC6A439498B816DC46 |
148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268 |
|
0x31
|
npdrm | 4.00-4.11 | 0x19 np | 4.00++ | dec | FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3 |
F72C1D80FFDA2E3BF085F4133E6D2805 |
637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42 |
|
0x24
|
app | 4.00-4.11 | 0x1A | 4.00++ | dec | 5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9 |
1AC8FA3B3C90F8FDE639515F91B58327 |
BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23 |
|
0x17
|
seven | 4.00-4.11 | 0x00 | =>4.00 <=4.11 | dec | 751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8 |
23AE4ADA4D3F798DC5ED98000337FF77 |
1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36 |
|
0x1A
|
app | 4.00-4.11 | 0x1B | =>4.00 <=4.11 | dec | 66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B |
9F7B5713A5ED59F6B35CD8F8A165D4B8 |
4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB |
|
0x12
|
npdrm | 4.00-4.11 | 0x1B np | =>4.00 <=4.11 | dec | BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B |
D03979E47D236BD278EC7331B7DA0BD4 |
4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848 |
|
0x17
|
app | 4.20-4.91 | 0x1C | 4.20++ | dec | CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752 |
FD40664E2EBBA01BF359B0DCDF543DA4 |
36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893 |
|
0x09
|
npdrm | 4.20-4.91 | 0x1C np | 4.20++ | dec | 8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F |
246F4B8328BE6A2D394EDE20479247C5 |
503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762 |
|
0x30
|
app | 4.20-4.91 | 0x1D | 4.20++ | dec | D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E |
ACB9945914EBB7B9A31ECE320AE09F2D |
430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879 |
|
0x1A
|
seven | 4.20-4.91 | 0x00 | 4.20++ | dec | 46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9 |
BF036387CDB613C0AC88A6D9D2CC5316 |
A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952 |
|
0x0F
|
AppLdr HMAC Key
A09B58A612B9F4C13451A1B81C94ABF8423ED76A96271A722394F0DD042BA2CAA41A567177A8B500235C74495842BF2007FAF274CC81091AD57AF7264A60E2CE
Used for lv2 memory check.
This key was implemented since 3.55.
Lv1 used lv2ldr to generate the hash when it loads LV2 then used appldr to verify generated hash when it loads self file.
- Location: lv2ldr, appldr inside lv0 (3.61+) outside lv0 (3.55, 3.60)
- Note: unlike some people have stated, there isn't only one section being verified. 7 sections are verified, and these are: core, text, rodata, ctors, toc1, opd and finally toc
- Note: hash value is stored in .bss segment of lv1 and transfered to SPU through the SharedLS.
typedef struct {
uint64_t lv2_mem_offset;
uint64_t hashed_data_size;
uint8_t[0x14] hmac_hash;
uint8_t[0x0C] pad;
} LV2_MEMORY_PROTECTION_ARGUMENTS;
riv_key
What is this used for ?
riv_key: 00000000000000000000000000000000 riv_iv: 00000000000000000000000000000000
- See also :/)
- Location: appldr
NPDRM Keys
a screenshot of a few NPDRM key files
NPDRM Activation ECDSA Public Key
public key : 6227B00A02856FB04108876719E0A0183291EEB96E736ABF81F70EE9161B0DDEB026761AFF7BC85B
Location: PSP npdrm.prx, PS3, PS Vita.
Algorithm: Applies to both NPDRM act.dat and to NPDRM .rif.
PSP EDAT ECDSA Public Key
edat_ecdsa_pub_key_x: 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521 edat_ecdsa_pub_key_y: 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D
ECDSA curve type: 2 (vsh)
Location: PSP npdrm.prx.
PSP EDAT ECDSA Private Key
edat_ecdsa_private_key: E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD
Location: ? Maybe retrieved by PS3 ECDSA randomization fail.
PSISOIMG0000 ECDSA Public Key
psisoimg0000_ecdsa_pub_key_x: 948DA13E8CAFD5BA0E90CE434461BB327FE7E080 psisoimg0000_ecdsa_pub_key_y: 475EAA0AD3AD4F5B6247A7FDA86DF69790196773
ECDSA curve type: 2 (vsh)
- Location: ps1_netemu.self (PS3 FW >= 1.70), ps1_newemu.self (PS3 FW >= 2.10)
PSISOIMG0000 ECDSA Private Key
psisoimg0000_ecdsa_private_key: 00BF21224B041F29549DB25E9AADE19E720A1FE0F1
- Location: ps1_netemu.self (PS3 FW >= 1.70), ps1_newemu.self (PS3 FW >= 2.10)
This key is used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes. See also PSISOIMG0000.
NPUMDIMG ECDSA Public Key
npumdimg_ecdsa_pub_key_x: 0121EA6ECDB23A3E2375671C5362E8E28B1E783B npumdimg_ecdsa_pub_key_y: 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B
ECDSA curve type: 2 (vsh)
NPUMDIMG ECDSA Private Key
npumdimg_ecdsa_private_key: 14B022E892CF8614A44557DB095C928DE9B89970
This key is used to sign the NPUMDIMG data inside PSN NPDRM EBOOT.PBP.
There is even a thread asking about the size limitation of the "Bubbles" method: http://www.wololo.net/talk/viewtopic.php?f=54&t=40931.
With this key you no longer need to use a base game to sign your homebrew, so the fake_np EBOOT.PBP size limitation is no longer an issue.
- Source: Hykem
- Application: [sign_np by Hykem updated by Sorgigolova]
NPD CID-FN Hash AES-CMAC Key
npd_cid_fn_hash_aes_cmac_key: 9B515FEACF75064981AA604D91A54E97
Temp name was npdrm-omac1-key-3.
Algorithm: AES-CMAC over 0x30 bytes of CONTENT_ID concatenated with variable-sized NPD-bearing filename.
Location: PS3 OS as it is used in PS3 NPD.
NPD Header Hash XOR Key
npd_header_hash_xor_key: 6BA52976EFDA16EF3C339FB2971E256B
Temp name was npdrm-omac1-key-2.
Algorithm:
1) Get AES-CMAC Key: (NPD Header Hash AES-CMAC key = npd_header_hash_xor_key XOR klicensee). 2) Compute AES-CMAC on first 0x60 bytes of NPD Header.
Location: PS3 OS as it is used in PS3 NPD.
ps3_klic_dec_key
ps3_klic_dec_key_old: DC41D59080BFFF45547D0B3A12E591D3
ps3_klic_dec_key: F2FBCA7A75B04EDC1390638CCDFDD1EE
- See: here.
Location: PS3 appldr. ?Is it also used on PSP/PS Vita?
Algorithm: See NPDRM.
NP Activation Data Index Decryption key
Used to decrypt act.dat key index from .rif file at offset 0x40.
Also named ".rif Key".
np_act_data_index_dec_key: DA7D4B5E499A4F53B1C1A14A7484443B
- Location: PS3 vsh.self, PSP npdrm.prx.
Act.dat key (debug)
E8205BCD11573530BE8DED1682936AF6
Unknown purpose, but seems to decrypt the debug section of the act.dat.
- Location: lv2_kernel.self (since PS3 FW 1.80)
Unknown key
69B453F2E421898E53E4A35A5B917951
Location: npdrm.prx (PSP FW 6.61).
Algorithm: used for DRM Type 3 (Free) when there is no act.dat need.
klicensee constant
Also named "act.dat Key".
klicensee_const: 5E06E04FD94A71BF0000000000000001
Location: ?PS3 lv2_kernel.self?
Algorithm: Used to convert klicensee (except the DRM Type Free constant klicensee which remains the same) to NPDRM content actual AES Key. See NPDRM.
Default Licensee Keys
PS3 Free License klicensee
klic_ps3_free: 72F990788F9CFF745725F08E4C128387
Temp name was ps3_klic_free_key, npdrm-omac1-key-1, but it is not even an AES-CMAC key, just a licensee key.
PSP klicensee
Used as klicensee for PSP ISO.BIN.EDAT and for Minis ISO.BIN.EDAT.
klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E
Location: ?PS3 psp_emulator.self?
PS1 klicensee
Used as klicensee for PS1 ISO.BIN.EDAT.
klic_ps1: 52C0B5CA76D6134BB45FC66CA637F2C1
- Location: PS3 ps1_netemu.self
PSP Remasters klicensee
klic_pe: 0DB85732366CD734FC879E743343BB4F
- Location: PS3 psp_emulator.self
NPDRM PKG AES Keys
NPDRM PKG PS3 AES Keys
npdrm_pkg_ps3_aes_key: 2E7B71D7C9C9A14EA3221F188828B8F8
- Location: nas_plugin.sprx, from PS3 FW 3.55 CEX: sub_36EEC, offset: 0x361F6@elf file.
npdrm_pkg_ps3_idu_aes_key: 5DB911E6B7E50A7D321538FD7C66F17B
- Location: nas_plugin.sprx, from PS3 FW 2.60 IDU: FUN_00027f98
NPDRM PKG PSP AES Keys
npdrm_pkg_psp_aes_key: 07F2C68290B50D2C33818D709B60E62B
- Location: nas_plugin.sprx, from PS3 FW 3.55 CEX: sub_36EEC, offset: 0x3724A@elf file
npdrm_pkg_psp_idu_aes_key: 7547EE76CA8C55AC1BA8D22535E05593
- Location: nas_plugin.sprx, from PS3 FW 2.60 IDU: FUN_00027f98
Concerns PSP, Minis, PS1 contents.
NPDRM PKG PS Vita AES Keys
npdrm_pkg_psp2_aes_key: E31A70C9CE1DD72BF3C0622963F2ECCB npdrm_pkg_psp2_livearea_aes_key: 423ACA3A2BD5649F9686ABAD6FD8801F npdrm_pkg_psm_aes_key: AF07FD59652527BAF13389668B17D9EA
- Location: somewhere in PS Vita OS.
Algorithm:
- NPDRM PKG AES-CMAC (AES-128-CBC MAC) Hash verification/generation using always npdrm_pkg_ps3_aes_key / npdrm_pkg_ps3_idu_aes_key, whatever the platform is. See PKG files#PKG Digest. PSM PKGs seem to fail both the SHA1 and AES-CMAC digest header checks following the wiki informations but windsurfer's tool might have the solution.
- NPDRM PKG AES-128 decryption/encryption using the per-platform key and per-platform algorithm. AES-128 IV is derived from pkg_data_riv in PKG Header. See PKG_files#Decryption.
NPDRM PKG/SELF ECDSA Public Key
ECDSA Public key: E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9
ECDSA Public bak: D9AAEB6054307FC0FB488B15AE11B558C75FC8A3EC4907E129C5B5CD386D94D82318B9D558777C5A
What is this?
ECDSA curve type: 2 (vsh).
Location: PS3 nas_plugin.prx, PS3 download_plugin.prx, PS Vita GameCard Auth Mgr.
Algorithm:
1) Get a NPDRM .pkg. 2) Get signature: header_npdrm_signature offset 0x90 size 0x28 PKG header NPDRM ECDSA (R_sig, S_sig) 3) Get data: 0x00-0x7F (or -0x8F) 4) Get public key. 5) Get curve. 6) Verify result.
ECDSA Curve Type 2 (VSH)
curve : 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000 00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06 0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92 F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1 9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520
inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9 FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D 0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000 0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E 63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF
Other representation: https://github.com/balika011/DC-M33/blob/master/psptools/psptool/kirk.py#L158.
- This curve is used for example for rif/act.dat, most IdStorage Certificates.
Snowden Key
9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397
- Location: vsh.elf or vshnet.prx into old firmwares
VSH CryptoEngine HMAC-SHA1 Keys
key0 685E2534695D79096F57640044315B515E0C7E55 key1 46753933634D1A1D464142752110116F2C5E7836 key2 59CB6067574D873CEFD7B75A300529C18BFB75ED key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2 key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5 key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48 key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933
PS2emu Keys
MC_CARDKEY_MATERIAL_1 6C26D37F46EE9DA9 <-mc_iso MC_CARDKEY_HASHKEY_1 CE62F68420B65A81E459FA9A2BB3598A <-mc_iso MC_CARDKEY_MATERIAL_2 2CD160FA8C2ED362 <-mc_iso MC_CARDKEY_HASHKEY_2 7014A32FCC5B1237AC1FBF4ED26D1CC1 <-mc_iso MC_CHALLENGE_MATERIAL 2C5BF48D32749127 <-mc_iso MG_KBIT_MATERIAL 35C860019222BB60 <-me_iso MG_KC_MATERIAL 8C2BD03EC245C56D <-me_iso MG_KBIT_MASTER_KEY 5001C87121F939C144D86B069224B247 <- me_iso MG_KC_MASTER_KEY 77F38314B047D87C9B37D266049228C4 <- me_iso META_KEY_RETAIL 389DCBA5203C8159ECF94C9393164CC9 <- sb_iso DATA_KEY_RETAIL 1017823463F468C1AA41D700B140F257 <- sb_iso VMC_KEY_RETAIL 64E30D19A16941D677E32EEBE07F45D2 <- sb_iso META_KEY_DEBUG 2B05F7C7AFD1B169D62586503AEA9798 <- sb_iso DATA_KEY_DEBUG 74FF7E5D1D7B96943BEFDCFA81FC2007 <- sb_iso VMC_KEY_DEBUG 30479D4B80E89E2B59E5C9145E1064A9 <- sb_iso MG_SIG_HASH_KEY 65E88B1A9E3FD268 <- me_iso MG_SIG_MASTER_KEY 51ED689419A83AD8 <- me_iso MG_IV_CONTENT_TABLE 20CB60F58D24BE50 <- me_iso MG_ROOTSIG_MASTER_KEY D56604A445781EC4 <- me_iso MG_ROOTSIG_HASH_KEY E773089E35D26A1B38C761029437CEE3 <- me_iso MG_IV_BLOCK 7D16C46313C3711C <- me_iso
LV2 Kernel 3Des Key
57C3E792E8D03DC4D2D72DFA4F81FB2889170959
- used in conjuction with ivs_3des
PSPemu and PS1emu Keys
Kirk Keys
Notes:
- Kirk command 0x11 is not vulnerable to retrieval of ECDSA private key. KIRK commmand 1 is.
- Besides Kirk command 1, everything else from the PSP (for example KIRK command 0x11) uses curve type 2 (VSH). Kirk command 1 uses curve type 1.
See also:
KIRK command 1 Keys
Kirk command 1 CMAC
// Kirk command 1 AES128-CMAC key kirk_command_1_cmac_key = 98C940975C1D10E87FE60EA3FD03A8BA
Kirk command 1 ECDSA Keys
// Kirk command 1 ECDSA Private Key kirk_command_1_ecdsa_priv = F392E26490B80FD889F2D9722C1F34D7274F983D
// Kirk command 1 ECDSA Public Key // Since public key is hardcoded, it is also included kirk_command_1_ecdsa_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 kirk_command_1_ecdsa_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39
Kirk command 0x10 Default ECDSA Keys
// Emulated Kirk command 0x10 ECDSA Default Private Key kirk_command_0x10_priv_key = 993150A4524E35F4DA5608630E23D959839F53DB
// Emulated Kirk command 0x10 ECDSA Default Public Key kirk_command_0x10_pub_key_x = 987FBEEE85F85B51BA823267EE1822F20EAC7889 kirk_command_0x10_pub_key_y = 3D4FD43EDE57E615B4636B621037399EB03D0E16
Kirk commands 1, 0x11 - ECC Curves
// Common Curve paramters p and a ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon
// Kirk command 1 - Unique curve parameters for b, N and base point G ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9 ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0
Kirk commands 0xC, 0xD, 0x10, 0x11 - Unique curve parameters for b, N and base point G
Since public key is variable, it is not specified here.
ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B // mon ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127 Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF
Kirk commands 4 and 7 AES128CBC Keys
2C92E5902B86C106B72EEA6CD4EC7248 058DC80B33A5BF9D5698FAE0D3715E1F B813C35EC64441E3DC3C16F5B45E6484 9802C4E6EC9E9E2FFC634CE42FBB4668 99244CD258F51BCBB0619CA73830075F 0225D7BA63ECB94A9D237601B3F6AC17 6099F28170560E5F747CB520C0CDC23C 76368B438F77D87EFE5FB6115939885C 14A115EB434A1BA4905E03B617A15C04 E65803D9A71AA87F059D229DAF5453D0 BA3480B428A7CA5F216412F70FBB7323 72AD35AC9AC3130A778CB19D88550B0C 8485C848750843BC9B9AECA79C7F6018 B5B16EDE23A97B0EA17CDBA2DCDEC46E C871FDB3BCC5D2F2E2D7729DDF826882 0ABB336C96D4CDD8CB5F4BE0BADB9E03 32295BD5EAF7A34216C88E48FF50D371 46F25E8E4D2AA540730BC46E47EE6F0A 5DC71139D01938BC027FDDDCB0837D9D 51DD65F071A4E5EA6AAF12194129B8F4 03763C6865C69B0FFE8FD8EEA43616A0 7D50B85CAF6769F0E54AA8098B0EBE1C 72684B32AC3B332F2A7AFC9E14D56F6B 201D31964AD99FBF32D5D61C491BD9FC F8D84463D610D12A448E9690A6BB0BAD 5CD4057FA13060440AD9B6745F244F4E F48AD678599C22C1D411933DF845B893 CAE7D287A2ECC1CD94542B5E1D9488B2 DE26D37A39956C2AD8C3A6AF21EBB301 7CB68B4DA38D1DD932679CA99FFB2852 A0B556B469AB368F36DEC9092ECB41B1 939DE19B725FEEE2452ABC1706D14769 A4A4E621382EF1AF7B177AE842AD0031 C37F13E8CF84DB34747BC3A0F19D3A73 2BF7838AD898E95FA5F901DA61FE35BB C704621E714A66EA62E04B203DB8C2E5 C933859AAB00CDCE4D8B8E9F3DE6C00F 1842561F2B5F34E3513EB78977431A65 DCB0A0065A50A14E59AC973F1758A3A3 C4DBAE83E29CF254A3DD374E807BF425 BFAEEB498265C57C64B8C17E19064409 797CECC3B3EE0AC03BD8E6C1E0A8B1A4 7534FE0BD6D0C28D68D4E02AE7D5D155 FAB35326974F4EDFE4C3A814C32F0F88 EC97B386B433C6BF4E539D95EBB979E4 B320A204CF480629B5DD8EFC98D4177B 5DFC0D4F2C39DA684A3374ED4958A73A D75A5422CED9A3D62B557D8DE8BEC7EC 6B4AEE4345AE7007CF8DCF4E4AE93CFA 2B522F664C2D114CFE61318C56784EA6 3AA34E44C66FAF7BFAE55327EFCFCC24 2B5C78BFC38E499D41C33C5C7B2796CE F37EEAD2C0C8231DA99BFA495DB7081B 708D4E6FD1F66F1D1E1FCB02F9B39926 0F6716E180699C51FCC7AD6E4FB846C9 560A494A844C8ED982EE0B6DC57D208D 12468D7E1C42209BBA5426835EB03303 C43BB6D653EE67493EA95FBC0CED6F8A 2CC3CF8C2878A5A663E2AF2D715E86BA 833DA70CED6A2012D196E6FE5C4D37C5 C743D06742EE90B8CA75503520ADBCCE 8AE3663F8D9E82A1EDE68C9CE8256DAA 7FC96F0BB1485CA55DD364B77AF5E4EA 91B765788BCB8BD402ED553A6662D0AD 2824F9101B8D0F7B6EB263B5B55B2EBB 30E2575DE0A249CEE8CF2B5E4D9F52C7 5EE50439623202FA85393F72BB77FD1A F88174B1BDE9BFDD45E2F55589CF46AB 7DF49265E3FAD678D6FE78ADBB3DFB63 747FD62DC7A1CA96E27ACEFFAA723FF7 1E58EBD065BBF168C5BDF746BA7BE100 24347DAF5E4B35727A52276BA05474DB 09B1C705C35F536677C0EB3677DF8307 CCBE615C05A20033378E5964A7DD703D 0D4750BBFCB0028130E184DEA8D48413 0CFD679AF9B4724FD78DD6E99642288B 7AD31A8B4BEFC2C2B39901A9FE76B987 BE787817C7F16F1AE0EF3BDE4CC2D786 7CD8B891910A4314D0533DD84C45BE16 32722C8807CF357D4A2F511944AE68DA 7E6BBFF6F687B898EEB51B3216E46E5D 08EA5A8349B59DB53E0779B19A59A354 F31281BFE69F51D164082521FFBB2261 AFFE8EB13DD17ED80A61241C959256B6 92CDB4C25BF2355A2309E819C9144235 E1C65B226BE1DA02BA18FA21349EF96D 14EC76CE97F38A0A34506C539A5C9AB4 1C9BC490E3066481FA59FDB600BB2870 43A5CACC0D6C2D3F2BD989676B3F7F57 00EFFD1808A405893C38FB2572706106 EEAF49E009879BEFAAD6326A3213C429 8D26B90F431DBB08DB1DDAC5B52C92ED 577C3060AE6EBEAE3AAB1819C571680B 115A5D20D53A8DD39CC5AF410F0F186F 0D4D51AB2379BF803ABFB90E75FC14BF 9993DA3E7D2E5B15F252A4E66BB85A98 F42830A5FB0D8D760EA671C22BDE669D FB5FEB7FC7DCDD693701979B29035C47 02326AE7D396CE7F1C419DD65207ED09 9C9B1372F8C640CF1C62F5D592DDB582 03B302E85FF381B13B8DAA2A90FF5E61 BCD7F9D32FACF847C0FB4D2F309ABDA6 F55596E97FAF867FACB33AE69C8B6F93 EE297093F94E445944171F8E86E170FC E434520CF088CFC8CD781B6CCF8C48C4 C1BF66818EF953F2E1266B6F550CC9CD 560FFF8F3C9649144516F1BCBFCEA30C 2408DC753760A29F0554B5F243857399 DDD5B56A59C55AE83B9667C75C2AE2DC AA686772E02D44D5CDBB6504BCD5BF4E 1F17F014E777A2FE4B136B56CD7EF7E9 C93548CF558D7503896B2EEB618CA902 DE34C541E7CA86E8BEA7C31CECE4360F DDE5FF551B74F6F4E016D7AB22311B6A B0E93521333FD7BAB4762CCB4D8008D8 381469C4C3F91B9633638E4D5F3DF029 FA486AD98E6716EF6AB087F589457F2A 321A091250148A3E963DEA025932E18F 4B00BE29BCB02864CEFD43A96FD95CED 577DC4FF0244E28091F4CA0A7569FDA8 835336C61803E43E4EB30F6B6E799B7A 5C9265FD7B596AA37A2F509D85E927F8 9A39FB89DF55B2601424CEA6D9650A9D 8B75BE91A8C75AD2D7A594A01CBB9591 95C21B8D05ACF5EC5AEE77812395C4D7 B9A461643633FA5D9488E2D3281E01A2 B8B084FB9F4CFAF730FE7325A2AB897D 5F8C179FC1B21DF1F6367A9CF7D3D47C
// KIRK Unknown PS3 Key kirk_unk100 = 000102030405060708090A0B0C0D0E0F
PSP IdStorage Master Key
psp_idstorage_master_key = 475E09F4A237DA9BEFFF3BC077143D8A
DOCUMENT.DAT
des key: 39F7EFA16CCE5F4C des iv: A819C4F5E154E30B
- Location: ps1_netemu.self
CHNNLSV SaveData keys
sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF sdHashKey3 = 36A53EACC5269EA383D9EC256C484872 sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203 sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86 sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B sdHashKey7 = EC6D29592635A57F972A0DBCA3263300
AMCTRL keys
amHashKey1 = 9C48B62840E6533F05113A4E65E63A64 amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445 amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E
PEmuCoreLib Key (3DES)
erk: EF690EC0E0BFA41F08455BD038EB8762DA3923EF9C61B930 riv: 2DEE8950969112D9
Idpstealer Key?
- DES encrypt 192? bit
key: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E iv: 0000000000000000
- Location: explore_plugin.sprx, vsh.self
Idpstealer Key Confusion
- usage:
idpstealer.exe idps.bin
- output:
SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E
TMDB Key
- This is a HMAC-SHA1 key.
F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197CF1AED3B7E9671EEB56CA6753C2E6B0
- Location: explore_plugin.sprx
It is used to generate URLs to obtain Title infos.
For example, title_id: BLES01133
Seed will contain BLES01133_00
openssl dgst -mac hmac -macopt hexkey:F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197
CF1AED3B7E9671EEB56CA6753C2E6B0 -sha1 seed
HMAC-SHA1(seed.bin) = 93ec11e04b137b433a9c867603e64660782a762e
URL will be: http://tmdb.np.dl.playstation.net/tmdb/BLES01133_00_93EC11E04B137B433A9C867603E64660782A762E/BLES01133_00.xml
Sbox Values
D/L | hex | Note |
---|---|---|
S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box)
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGðÔ¢¯œ¤rÀ 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&6?÷Ì4¥åñqØ1. 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„ 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P<Ÿ¨ 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ"*.ˆFî¸.Þ^.Û 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®. 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p>µfH.ö.a5W¹†Á.ž 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T». |
Present in all SPU binaries that perform AES (see here) | |
Inverse AES S-box
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С% 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’ 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„ 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE. 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 :‘.AOgЬк—тПОрґжs 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t"з.5…вщ7и.uЯn 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ. 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV>KЖТy љЫАюxНZф 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_ 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61 а;M®*х°Ил»<ѓS™a 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&бi.cU!.} |
||
DES Sbox 1
01 01 04 00 00 00 00 00 00 01 00 00 01 01 04 04 01 01 00 04 00 01 04 04 00 00 00 04 00 01 00 00 00 00 04 00 01 01 04 00 01 01 04 04 00 00 04 00 01 00 04 04 01 01 00 04 01 00 00 00 00 00 00 04 00 00 04 04 01 00 04 00 01 00 04 00 00 01 04 00 00 01 04 00 01 01 00 00 01 01 00 00 01 00 04 04 00 01 00 04 01 00 00 04 01 00 00 04 00 01 00 04 00 00 00 00 00 00 04 04 00 01 04 04 01 00 00 00 00 01 00 00 01 01 04 04 00 00 00 04 01 01 00 00 01 01 04 00 01 00 00 00 01 00 00 00 00 00 04 00 01 01 00 04 00 01 00 00 00 01 04 00 01 00 00 04 00 00 04 00 00 00 00 04 01 00 04 04 00 01 04 04 01 01 04 04 00 01 00 04 01 01 00 00 01 00 04 04 01 00 00 04 00 00 04 04 00 01 04 04 01 01 04 00 00 00 04 04 01 00 04 00 01 00 04 00 00 00 00 00 00 01 00 04 00 01 04 00 00 00 00 00 01 01 00 04 |
Plain SBOX values
Forward
63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16
Inverse
52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D
In another form (from updater in ebootroms): dead links.
RCON
01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00 10 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00 40 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00 1B 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00 36 00 00 00
Shuffles
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F
ShiftRows tab
00 05 0A 0F 04 09 0E 03 08 0D 02 07 0C 01 06 0B 05 0A 0F 00 09 0E 03 04 0D 02 07 08 01 06 0B 0C 0A 0F 00 05 0E 03 04 09 02 07 08 0D 06 0B 0C 01 0F 00 05 0A 03 04 09 0E 07 08 0D 02 0B 0C 01 06
InvShiftRows tab
00 0D 0A 07 04 01 0E 0B 08 05 02 0F 0C 09 06 03 0D 0A 07 00 01 0E 0B 04 05 02 0F 08 09 06 03 0C 0A 07 00 0D 0E 0B 04 01 02 0F 08 05 06 03 0C 09 07 00 0D 0A 0B 04 01 0E 0F 08 05 02 03 0C 09 06
Td0/Te1
See [this] and AES binaries with sbox repeated 4 times.
T5
- Location: in lv2_kernel
- See this
Disc id for HDD
D1C1E10B9C547E689B805DCD9710CE8D
- Used for hdd-boot game saves as hashkey.
- Location: ss_server1.fself in lv1