Keys

Illegal Numbers - Numberphile

Keys Notes

You can download the keys from: ps3keys (or for scetool here : scetool/data/) ps3keys at Github / http://www.mirrorcreator.com/files/JSM2FRCD/ps3keys.exe_links ps3keys in RAR sfx (254.01 KB) / ps3keys.zip (229.9 KB)

Location

keyfiles should be placed in ~/.ps3 or %userprofile%\ps3keys

Naming

naming:

• file prefix: lv0, lv1, lv2, app, iso, ldr, pkg, spp, np

(NB: some tools use np- others drm-, or npdrm- prefix, uniform naming in all tools is adviced)

• file suffix: .092 .315 .341 .350 .355 .356

(NB: actually 080, 092, 240, 340, 350, 355, 356, 360, 365, 370 ...)

• key file (erk): %s-key-%s
• iv file (riv): %s-iv-%s
• ctype file (curvetype): %s-ctype-%s
• pub file (public): %s-pub-%s
• priv file (private): %s-priv-%s

Key Table Structure

generic in loaders

Keys are kept in tables and indexed by the sdk_type in the SELF header.

struct key_obj {
    uint8_t  key[0x20];
    uint8_t  iv[0x10];
    uint8_t  pub[0x28];
    uint32_t curve_type;
    uint32_t always_zero?; // most likely padding: keys must be 16 byte aligned for the crypto routines
}

appldr specific

  typedef struct _appldr_key_container
   {
                  /* start-end (length) */
     u8 key[32];  /* 0x00-0x19 (0x20)   */ (AES:ERK - 256bit Encryption Round Key)        */
     u8 iv[16];   /* 0x20-0x2f (0x10)   */ (AES:RIV - 128bit Reset Initialization Vector) */
     u8 pub[40];  /* 0x30-0x57 (0x28)   */ (ECDSA:public - 320bit)                        */
     u32 ctype;   /* 0x58-0x5b (0x04)   */ (ECDSA:curvetype - 32bit formatted 8bit value) */
     u32 null;    /* 0x5c-0x5f (0x04)   */ (always zero - 32bit formatted)                */
                  /* 0x00-0x5f (0x60)   */ (total per revision/type entry - 768bit)       */
   } appldrKeyContainer;
   
   appldrKeyContainer rev0x00_0x0c_1[13];
    
   appldrKeyContainer rev0x00_0x0c_2[13];
   
   appldrKeyContainer unknown;
   
   appldrKeyContainer npdrm_1[13];
   appldrKeyContainer npdrm_2[13];
   
   appldrKeyContainer revoke;

ECDSA Curves Notes

• First curve (type 0) is probably reserved (and cannot be used because it is an invalid curve that serves no purpose since it is fully zeroed).
• Second curve (type 1) is ONLY used in KIRK command 1 parameters (which means that some of the keys/curves from PSP were ported to PS3).
• Third curve (type 2 - vsh) is the most widely used curve and serves general use purpose.
• EID0 section 0 (and certainly EID0 sections 1, 2, 3, 4 too) uses another curve, found by naehrwert in 2013. See EID0 Keys.
• PS Vita uses most of these curves for 160bit ECDSA operations but also has additional curves for 224bit ECDSA equivalent operations.

Key Scrambling

Starting with PS3 firmware 3.60, loader keys have been encrypted. Look here (dead link) for a tool that decrypts them.

Besides that, there is an implementation (dead link) of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side.

Root scramble keys

type	version	key	obfuscated key
root	3.60-3.61	844F80F3C57C455C7F09	was not obfuscated
root	3.65-3.66	865128F745845947A0CE	C713D2DFDFD47DDAB4D4B2666E904577
root	3.7x	0DAD161222CDDB00A631	06EE2ABE898525C0EC8A836FDEB60F9B
root	4.00-4.1x	D029857926C7A918D48E	8E18822A713B37FEBA2EC0092FC84D3B
root	4.20-4.91	F5FD0DFD54B738FC8895	8B77B209CD58C688CF5E38C8FAFD781B

Root crypto SPU keys

version	erk	riv
4.20-4.91	E044C1E29C53FEF2E064E31207D09D48676719789D59E5C1F004D002390F2360 8350EBCCCA16A69A08E2A813F18B92EF688B163CB6C4781F0285AEAD4DAB0FD2 555A7B10D87DA8C9257136546E1A6A33782DC8C1B1A888A3FB2000EFBC12DE7F FC6EC40EC3782C8C53625B96E72334E67073EC2C0395A5DB0A1CACA119E61A86 ADA4401ADD1CC764A0C2DB4D58E13F8B23515AB750DCED2BAE626CCE7FD07242 E2BF4D2503282798E4A736ACC388412D	20385B4B1819FD8E691BBEF17001392B

Lv0 crypto PPU keys

version	erk	riv
4.20-4.91	31A57D41FF28CD29721B41D347F48809D01E8C70A8F297D2F652C298315D9D4F D3ADB79D9BC55C38BF49F8664FB84281145A935130D5A22AAE065D2B3542175D 36337FA72E0C24F10B8605BB1957D81D6DA1D45DCEBF6B503283905BC1F656CC D23F408234778FBCA0DAD68C625951E20C2CF06A001CDA65E715148CF1EEB294 D2C4EABF968CFA6F23608F6F6257F317F53FD595A656EDC8739596EA6F254292 17EC4391566D330DB1FE95CDF45B9F3B	B5F9F0E46307DBFA5F54BE397475E2BB

Scramble keys

type	version	key1	iv1	key2	iv2
isoldr	3.60-3.61	5389A6DFA8567D43A80DA6DAB90EE946	A51A2C7960AC1BE43AA0FB7695094188	212E7E92FF1FB75AE5C1323037C34693	90AF09A666BB0C663BF2FC8E5338B7B8
isoldr	3.65-3.66	E37A763FD7A559CFD7E1E2DA5C8CBAC4	198361A904E748381CB9AA1DF5CCAB17	23EAD00FC78D9A8B7785EB600124238C	61B0D045DF5727EFC19E5BE53BE70F14
isoldr	3.70-3.74	9FD83EA32E9EAA0EF54AD0CFBB60D1DF	194B649CDA9F4D814CD119C603E49FB5	A9709BE3E8043BA24635A2617541E9D5	F06A5B2FEF9CA87B1759DC53AEE1A3B5
isoldr	4.00-4.11	FFD6342FC86B81F0E56C6867D618D72A	A51A2C7960AC1BE43AA0FB7695094188	194922A1EEB01E614884A44D1D7B7FC1	90AF09A666BB0C663BF2FC8E5338B7B8
isoldr	4.20-4.91	4DEA657828657CA86AB93E2162592B97	F7B28A650B22AA54A9104CB9D96A4860	CE2D1A7AA4F4434058F0C8A64400CBF5	27C1B2C611EDC0E4A68A642FBB92A3A7
lv1ldr	3.60-3.61	F92C8666EFFBAC7EB583E54A257F7C05	F2E70BC4BAC10C3D8DDBB7DC23053F9A	DDF6A5B143C1141FEED01CDA719705C3	018E695C3A29AF6E746A73CBF73DBDFD
lv1ldr	3.65-3.66	546DE455AB15F33546D2296C2535FA44	ACA9C00DA6D778A95EBD9D76E659C14F	AB82EF1F62CC382CF2880A870499AE89	6ECB2AC4DA8D400F0167F1EB9FD8D7F1
lv1ldr	3.70-3.74	F98E56F3CB0D68797E3D81F0BE36CFBD	7DA5A5487AFA3032BF49D40CEBEC2480	7EAFED452D621269CB7EF46D7BE3DAD9	A5C6E2A25C2DD09D6597F69EEB3A2CE5
lv1ldr	4.00-4.11	80863EDBAE50DD4B16125FC9321BBC24	1A9E31FEBD603A9CBE4ECD6026292466	D4E2AA7293192CB1600D537A9E832F2D	4503E4E505A773C55E0B8E1332341287
lv1ldr	4.20-4.91	AC19D5DB427351434DC6DA3BD6E3DE6C	66E68237D5B7228AA2F057B6043768E1	466CD2F735628B8EF99D1793063BBB3B	761907BA41A7945028D8FD8305B25BD2
lv2ldr	3.60-3.61	A25E7F097B2FC7B1082032C4387DB335	0655809B26DF5F29E4E740D950A8CB53	6B97507247CD680FE56D9E19D06DFC71	B72B9DBB5C2CC74EB75C7B9815DBD5D8
lv2ldr	3.65-3.66	4B973A45A23894CBF0CDFC168B7EFB31	2210B3103E7EDFD8CE0B25551B1D4003	858CFE093654E3EFA16FCCE5F73C9591	481472B4DF63EA5F883DAA2872EE5D2F
lv2ldr	3.70-3.74	85AEC67CB85BD04D3E7D3D76AA604FF5	51B40C084A81C9BE35108FFC0C008F64	616004C6C2D614737106FE41668826A7	A765A845AAB477EABFEF4274ADA6AF04
lv2ldr	4.00-4.11	020397E6D292288F80659F06E2DACEFB	4CC9A8A9EED889070F066EC9A7CADA2B	577BA1CBF1FD40A3EF53C9B5DAC3AC60	B64BF3D04FBB3F8D29F9E63A97DF3DA9
lv2ldr	4.20-4.91	872D02292EE7ED3544AFF20EEA5E6F0C	2E0CBBD250150410302F7E8B33039EF3	A02BA1F74446E4BAE04AF5CF13D94154	2009879EED2F443367C80B62F9D1748F
appldr	3.60-3.61	EE409F8CD0B7F8AF17769D5F6D67EA3F	6BF7B2D5B0ED87EF4CF601D53EEA111A	2149690206DD0ABC0CD5367C4AF2C810	39D8E32CF3F1558902247F733D5284BF
appldr	3.65-3.66	D1FF8A1B7AD27A186B0F1E2FFF5C2B65	4D5EC61604BCE8250E62600376061878	8F40C9F3CEF5284F5F432BD906ECDF24	0B107F57C095B31EF15B95FFEC5134B2
appldr	3.70-3.74	2AF91823CE38598E8D66245F698AB572	D1A74E3DED98145F023F07FFB60D2B1D	04BE8DD318D3E7454A166296B022F88D	16D3B1E7B007FDFE101C029B5F39C761
appldr	4.00-4.11	6BFAFA124D4B88841BCB861364C32826	3F7679B0A1430C490C1F249EAA468D2C	4338700B5FA64276DD3E57806ED679FD	CFCAE1AF6F98E5651CBB021D78DD8F1B
appldr	4.20-4.91	AAF65A91EC372C690969090F59E53C3E	A5798C254313BC5416951E24EAD3C985	66BCB417D14A2B592640801C11B7B49B	2FF236152A4776DAD39B509244E8F5C2

Note: key1/iv1 are used for unscramble scrambled keys. key2/iv2 are used for unscramble scrambled IVs.

Scrambled keysets

Type	Version	ERK	RIV
rvk_prg	3.60-3.61	FB9CC7277F95F77E63618488AE38DB9C5226D988AF79CC4C0F49EC983FDC96D4	E06DC9567BE0EA09D5D1A5355B996FC6
rvk_prg	4.20-4.91	1FAED95E0BAB4BD4F9CAF9F9C0DAB5EBEFFB6CDAD6482ABF60DD73B0EA3FD0E8	30B9F738238A015014A44DD57B3A1661
isoldr	3.60-3.61	7CFE82A405C29EBE20BBA96BB1D1F6E9F31A01BF179018BE26F079808361ECF1	B3E9683977AE89DE9AFFE6330774505C
isoldr	3.65-3.66	1626B646CC8A8198DAC725CF616C442D855A1E3FBD5824BA9AA36F5FBC345CA0	2E691E3343A55B99E8A935B0443BD67B
isoldr	3.70-3.74	7DA7D447D0FD4088FFF2B858A266FEFECB3D2E79D68BCC0A70FF8B381258EFA7	E46F02FDCA9F40CC5CD715D930190FE0
isoldr	4.00-4.11	B2306998F30DEF6750E01674BCA38D46F8FAD1548B456C4F7869296F7DC27E83	2912F5FC4C4FF400940B369193303D16
isoldr	4.20-4.91	A4609638DC47355D6D7915F26E3837A1A02528AA7A1A27542231997EB4F7143D	36762D06A6F6FBFFE342D8853A3CD440
lv1ldr	3.60-3.61	18097966C3DE8A0D82BF956CB39FAF782295C6CA7F1E547AB30EDFD7EE5CB812	9B32B20FA77280F1095EA13F1C2D5C99
lv1ldr	3.65-3.66	760EA11735B587072EDD4FFD0BD31DD3BE9AB82188A344C81E7E4710F9607779	AC559E2326390686B064B6AC45753117
lv1ldr	4.20-4.91	189615862C02E6278760BA3A19C8BF0C176B6EDD491A40F2F3ED0091CEFA28C3	E372B32F7E439D30AC6CEC68CA23D903
lv2ldr	3.60-3.61	451E4179EF01987D64EA48841DCA5AA7CB3D6ADB8D880F52DAEF543E654BAE3F	E8831E56EF9FA4D8D4BF7A6E78025644
lv2ldr	3.65-3.66	2A0E7FD3DA4AC74D4AB2DD6AF36FED41CD5F50DECB7FC945F81A85460E141739	FD9D731564C1D1F0A4258667100D1F17
lv2ldr	3.70-3.74	7E115E8C38BEA057858E97F670EB3E6E2B8FA04C059422CC9273EF12335679B4	90A06C54C727844AB5300BB6AB54C537
lv2ldr	4.00-4.11	ECFAC7BA2F1BFA198A834EBC25B4FBD47448764A6E79A200C26948141A26B794	CF33BDA9F55C71BD9F38B31162FCB0E3
lv2ldr	4.20-4.91	B0B020CE5DE730AEFCD3778273F0F91456EBCCE8F184FC257D37E0182D20D328	2D4C6F9F0AAF26A728CA166D03449321
lv2ldr::rlist	4.20-4.91	62A5AEA5627F387BBEBFE437D3F440C13761403CC3AD65FCDC5478468D048685	DF0AA5EC856B48CA091D8F42A27319D5
edat-key-0	4.20-4.91	270C4A349DE7A329BB04FD8642C43591
edat-hash-0	4.20-4.91	25790BA9D671FB125E53F013B0F9862E
edat-key-1	4.20-4.91	D1DF87B5C1471B360ACE21315A339C06
edat-hash-1	4.20-4.91	6D4BF3D7245DB294B6C3F9E32AA57E79

Key lists

sc_iso module 060.013.r010 - 4.75

1:                                  //SRK (dynamic key, initial 0x10 bytes from system root info)
2: D413B89663E1FE9F75143D3BB4565274 (060.013.r010 - 4.75) //ss::sc_key::series_key
2: 73636B65795F7365726965736B657900 (INTERNAL)
3: FA72CEEF59B4D2989F111913287F51C7 (060.013.r010 - 4.75) //ss::sc_key::series_key2
3: 73636B65795F7365726965736B657932 (INTERNAL)
4: DAA4B9F2BC70B280A7B340FA0D04BA14 (095.001 - 3.56) //ss::sc_key::key_for_master
4: 29C194FFEC1FD14D4AAE006C32B35990 (3.60 - 4.75) //ss::sc_key::key_for_master.2 (new one)
4: 73636B65795F666F725F6D6173746572 (INTERNAL)
5:                                  (1.50+) //encrypted keyseed_for_srk2 (perconsole dynamic key)
6:                                  (1.50+) //encrypted seed_for_backup  (perconsole dynamic key)
7:                                  (2.40+) //encrypted sherwood_ss_seed (perconsole dynamic key)
8:                                  (2.40+) //encrypted ss_seed_one_more (perconsole dynamic key)

see also: http://pastie.org/3130817 / http://pastie.org/10206783

sb_iso_spu_module 083.006.r010 / 1.02

 0: 8E73EE9994E8A11C12300C34DA92D07FD8636E434C8FCA02 <- ss::sb_iso::magic_px
 1: 9D013CBE2D46368B4DB782FF2472ECE64237F3538827416E <- ss::sb_iso::fix2_px
 2: 086998B739554A8022372B883465DE5F718FC15DEE636447 <- ss::sb_iso::fix1_px
 3: 534740F254E3F83503BBD7DE9F091B67325F31A00C78F2A9 <- ss::sb_iso::magic_dx
 4: B62AB069608519CC7F69FC16D673ED085998A24A40B06AFF <- ss::sb_iso::fix2_dx
 5: 8094270BA87742F383F109F9C7D9E9755C4E343D81D2A3D9 <- ss::sb_iso::fix1_dx

sb_iso_spu_module 3.41

 6: C51272E64D9A15CA445CD2F3795C15B81B192C7AC15883F4 <- ss::sb_iso::fix1_sx
 7: E618B3A4EC2789DAFC2ED2DFED75A93FA7B55AEA201278A4 <- ss::sb_iso::fix2_sx
 8: D7C0AC46B1CD3E7345A0F0DAF921F6DDDA03A37905FBB17E <- ss::sb_iso::magic_sx
 9: E3F22665AFC4E1C014A431241DBC0B69D5D66857D91E6B27 <- ss::sb_iso::fix1_zx
 A: 66866AF7489AE85ABF98A670AA27672E066E60D14D524121 <- ss::sb_iso::fix2_zx
 B: EB9706B9A75A48853BD4035ADE936E050E87E742D27A8609 <- ss::sb_iso::magic_zx

note: 1.02 contains 6 keys, 3.41 contains 12 keys (it also includes the 1.02 keys)

sv_iso_spu_module 095.001 - 3.55

 key_0: EF4F6A107742E8448BC1F9D8F2481B31 // key_0 is an AES128CBC key, used with zero iv to obtain Disc_ID.
 
 iv_0(ss::giv): 2226928D44032F436AFD267E748B2393
 key_0_0(ss::kms1): 126C6B5945370EEECA68262D02DD12D2 // key_0_0 is used with iv_0 to generate gen_key_0(ss::sv_auth::ks1)
 key_0_1(ss::kms2): D9A20A79666C27D11032ACCF0D7FB501 // key_0_1 is used with iv_0 to generate gen_key_1(ss::sv_auth::ks2)
 
 key_1(Kwm):   7CDD0E02076EFE4599B1B82C359919B3 // key_1 is used with iv_0, decrypts disc_id from recieved data of the sv_wm_command
 
 iv_1(ivs_aes):    3BD624020BD3F865E80B3F0CD6566DD0 // iv_1 is used with gen_key_0 and gen_key_1

This key and this IV are used to derive the disc encryption key:

 key_2(Kh):   380BCF0B53455B3C7817AB4FA3BA90ED
 iv_2(IVh):    69474772AF6FDAB342743AEFAA186287

 debug_disc_fallback(ss::intikey): 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC' (used on PS3 and PS4?)
 
 ivs_3des: E80B3F0CD6566DD0
 
 eid4_fallback_0x00(ss::fix1_it) FF1471C135E4593D0D27F9CAA3795BD9 //used for bd-it as kf1_eid
 eid4_fallback_0x10(ss::fix2_it) DD38369F0175173CE32BEED051FD4EF3 //used for bd-it as kf2_eid

eid4_fallback keys added from this source

trivia (you can find these in the middle of the keys) [1]

ivs_3des also exists in lv2_kernel.self, as well as ivs_aes

 M1m. AES128 key: 27CBB8C5EF730EE48DB2771AAC2584D5
 M1m. HMAC-SHA1 key: D3865918B43AE81891ECEC337B74A8C38F1F1F45
 M1m. RSA exponent: 00010001
 M1m. RSA sig pub:  ABEFDE4DF9FE8D926314C9EB0E08FF27C7FE9E64B1D0263410614E9361403BDE6F2F192823432F731F02E62B1888D6885418FBB2D992AF2ED5D5C9D868A19482
                    E9A9C888746D05CFC60431F913D64B8D29B4A06D31F8EFF35AAA2B530C9E937974699C1BF1BA011F7E400188EC984B534AFCF6BFC9123AEC4951BFDC5FB76367
                    C40BF45E03B73F0621D45B49C13F84AB457F837AC2F479654926F0D5DFD48CD717C1DF3DFBABB2ED4D1C9F21AE3BAF30979022F94518AE99E1697F87CEFFFB68
                    473D1D5EBDCC1F4D377702DD549F066E3FE8991C3FAF4FA9AD5E1BAA428968D72FA89E644B75A71A66E5E92EB7D1E5B8D6ED60FE1BDEAC422BCB2189917FBD5B
 M1m. RSA sig priv: 021CA7296409B96973E81C76D3AC4E9E0979DA2E3874EB1336A44B57CA1904E33D906189B9AD28970C6977B44DCFD87AC235B059C90C61347D11EC31C94F3AC8
                    C4DFFE03971283C0C298E8983BA325386DABB750C00D63BD247EF49B478B671A55D0BA472997F44D93BA6B8A680592DF4A0B836865AAE0A8685A25B62A42D168
                    BEBB41A64B4F5AE5FA11139011AC8FC3493E67A7395A0A3FD8BA27DD61DBD1FB35E78DB5DCAC5777996E6300C28E94FCA738F76C1E64426CE4383EEA584F0E7D
                    D70DF2285932646D998F32B12C04EEEF9749AA3863D6D7F793A57C77EA3DB63FBFD0D610E2E0131252EB2BA05683154BCE8EBC499F33D7FFA2C11C9EC0030EA1
 M1m. RSA sig P:    D33C8EA25BA8282A3112E144D513E7699A61515D2095174A9F01D16742A194BD77403BBF88B2768183A1F285A1941246E073CFB0FAC3A98E143EB4D62A653DD6
                    09228D0DA3241DA7ACF8F1D1DA0C13BBC0203B28C25C1C97C179A256ABE585031472F2141BFF6A74F735AE43DB86AB67A2496CBC2E79F7E9972391BCE7FECC6B
 M1m. RSA sig Q:    D05F55F9AE87DE25BAFEA72177E531D11705BDD75A198C1E2B9348EBAE4EAFE6C803D4048742F86298D3E5CE1E09634724F22481E8E668DA9F54688EE8880A90
                    292ED95DB63F2E7D284A77F694EF810005E70D79FD68E2CC14E56435C9A40D576CC0AEA0A945EA78EAEB867155F56CEA88BDC32B82B60D3CAC95F3B305270ED1
 M1m. RSA sig DP:   3FA9F8B3263CC01E373C2178C55F82576997FB15BE443108E4737FD1475BBBA07ED875297CE18CA5EC2E5B11BB690D391F5CC833E6E021B21897ED98BE9E54CC
                    B5641C6F07C452CBBE6E2933BE2BF5A698791E5B6278B0856C6264730ACBDA12DB8EE936F6593C94940D31C071E15CB79749D9E3BD7E3521C9D3869110BAD291
 M1m. RSA sig DQ:   5194219AE123BC6B552C81CE6E9C42C6B396C1DE601E04678373E466B115897476F658B97523590F70F9F4CC9FA1D9466F4685D87E904698E12C30CB526A8088
                    34376D4E6D1D8B5BE0BC56FF290C239B18B47EE835B82CA2EDC3695A4D9976C7B582325C20298944D1E467FC534504E145ABD58F615B590F5A1A5310D1819B21
 M1m. RSA sig QP:   7FF06086CF3008E29BB3F17AF378D2FEDA69DE90810D22A902B9F2FED95C43D3D09A5A80F91036319E7369BA656CD3F9A84A9CF3D8A7EF655F8D2D0D9BAA294C
                    7614F34CA229171E12C9FCC2F197C8A6C7CE606B82A9A2304C8335426F4F74F8084FBAABD0D30B5B83D9396BB7578CEFF740C200602A820E94F9A893F9B2F826
 M1m. RSA cryptkey: B107EBE57C7A3D72F2FB11D292982C3ED522763BC85A028A7692E70FCE057D67F629FCFE267E36AEEDB3FAFB3501524CECAD9220156B55ABF702BA431B6C7BF3
                    6FD47E02904833B632BB1AB7DCB0CE65CFAE7B76A3E9990703CD0B80AFDF86FA0FB7959D99D251064EC39A9B85303C8BBC79DC8C96293EE8C4354C5E4AB795A4
                    F32348691C0D6163266F780B09D08ACA502C9E2A0ADDDA7B9C35DDC820B547783FB665C6721ABC10589A680A95DCAC6B9CBE45B2AFC76D6B1119C55C3A9591DD
                    1589DCCB352535C44409B26CD3B3330F5D162D0FEA489C5C7A3726F7AD46090B2132B130326610C24C751CA93FBB6DD8862249116BB6794F105D72E705C2361D
 NPpp aes key:      4867B35FB38774F665EB96E76F4D1665

PS3 ?4.86?:

uint8_t nppp_hmac_key[0x40] = {0x4E,0x43,0xBC,0x2C,0xAE,0xF6,0xF0,0xC3,0xE3,0xFB,0x4F,0xFA,0x8C,0x34,0x52,0x21,0x28,0xE3,0x6D,0x83,0xE7,0xEC,0x10,0xF8,0x23,0x86,0x2F,0x64,0x7A,0xB0,0xB5,0x88,0xA0,0xD8,0xAA,0x50,0xA9,0x6E,0x9E,0xD1,0xEB,0xA9,0x10,0xC0,0x7C,0x87,0x6F,0x5D,0x57,0x9C,0xC2,0xE7,0x06,0x48,0xBC,0xAE,0x98,0xD7,0x19,0xDB,0xD2,0x6C,0x2A,0x39};
uint8_t nppp_aes128cbc_key[0x10] = {0x48,0x67,0xB3,0x5F,0xB3,0x87,0x74,0xF6,0x65,0xEB,0x96,0xE7,0x6F,0x4D,0x16,0x65};
uint8_t nppp_aes128cbc_iv[0x10] = {0};

 ss::Kf1_u0: 213AA19F9640484DED1A90FF6E535BD9
 ss::Kf2_u0: 460BE7654AC4A8DFAA5F40A729E44EF3
 ss::Kf1_u1: 80025B9F4A03EFB144E7F2069D1B5BD9
 ss::Kf2_u1: F1F6045B66ABC69A2F62B25492A34EF3
 ss::Kf1_u2: 72F87767AC9362C87B97BBC8C0985BD9
 ss::Kf2_u2: DE29F0DFA04708E951781C25E49D4EF3
 ss::Kf1_u3: DC082F837F1487C2008B7BC920C55BD9
 ss::Kf2_u3: E80885F96ED0F36752CE52BEC3C74EF3
 ss::Kf1_u4: 19766FBC77E4E75CF441E48B942C5BD9
 ss::Kf2_u4: 50CBA7F0C2A7C0F6F33A214326AC4EF3

These keys used for auth_drive_user

 ss::user_param_u0: A97A0621F32A98B6BBCBD54A8BF250E4
                    ACE00B9571C37E44F95BBE4EE4DB93FE
                    00000000000000000000000000000000
                    D1E19EB3AAC6B8E29702FB1D414D7D17
 ss::user_param_u1: 55AFBA594107ABEC2AA8FAEC96D5D579
                    21004208287B6E7D6DBCCB5348403C59
                    01000000000000000000000000000000
                    DC8516DA4515EF85D2433F1115190E68
 ss::user_param_u2  95A5E268B73AB7B8B1126C35D5B5E5C6
                    30172A01C3B8350D8C4965A7C4BDFE3C
                    02000000000000000000000000000000
                    FF3A61D0ACE8BC097484718261E65FA1
 ss::user_param_u3  6317A8CD1250D70A195D7E02B0DB946F
                    CF2CCF4DEF20E74C9A1E6806028A0046
                    03000000000000000000000000000000
                    6E8A6F2DDE07202BF4D0BBDB8A0B805A
 ss::user_param_u4  1E79188E093BC87795B2CF2AE7AF9BB4
                    86801828C2CA05BAD1F278F1801FEACB
                    04000000000000000000000000000000
                    8DB3469342648160168F51D193762395

These keys used on sv_udata_command::set_command()

u0-4 is UserId, 2 for PS2 disc auth, 3 - PS3 disc auth, 4 - drive_auth, get_version, etc.

spu_token_processor

095.001 - 3.56:
token-hmac: CC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A
token-key:  341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED
token-iv:   E8663A69CD1A5C454A761E728C7C254E
3.60-4.91:
token-public:  A55476C9E6DFB890FAAF5FBFFD961B649D0ABF1D0CD76000BD4B5F5AFE0AB87DCEA221E252A37404
token-curve-type: 0x9

08x - ??? SD 
token-hmac internal: 646AC0DF49C333626C15F9C7CCDAE62DD882FBD223647AF41776E14D35984538CC525636330272EF7F26D883FB7041B44C2925485F9570F04DA2D18B7DA4CF1B
token-key internal:  8801A471102853DC867247974B68F9361EAD861C3A09346FEF25FE36D15751CA
token-iv internal:   FEA685F720B0C60A65DC97B8B2C8BCB3

spu_utoken_processor 3.55

utoken-hmac: 572C987747A4A0A6A1E715963D0DCCCA28A8A94B5B529472EF1A4EFFEB2978F99BD0A9D42438DB731B443C9DC7944A13AC7B40FCA57DFE33D212FBA86CBEBCBA
utoken-erk:  D1CB1C81ACE35F3D970DDE723A622935516F98D0F0DB3E151DE2B7A2E34BD736
utoken-iv:   A6523E5426470953FE8C90F61BCA927A

sc_iso

secure_com_lib_internal_key::BE_SC_PayloadKey: A3ADB99A21E47ADFF3FD7FC3173981CA       # 060.013.r010 - 4.91
secure_com_lib_internal_key::SC_BE_PayloadKey: 6933CEE7A518E5B8CBE1FC14B261B765       # 060.013.r010 - 4.91
secure_com_lib_internal_key::FactoryInit_Password : 2EA267093B4556ED9D3BE62E115D6D59  # 060.013.r010 - 1.70
sc_key::old_auth_key_1_0x00 : 13163A92B50513542C18ABAD31B85FB7
sc_key::old_auth_key_2_0x00 : 2BC8BB73F4B59AC658A737A5DD535DFE
sc_key::old_auth_key_1_0x01 : D6C374FCDFF8C3CF44018C78733BF5B2
sc_key::old_auth_key_2_0x01 : 648B9FF94EF321C69A4AE596F2F08D22
sc_key::old_auth_key_1_0x06 : 626C7124FC5BA1AF7436389BA37C6654
sc_key::old_auth_key_2_0x06 : 9D94BE461CAF083C9D9FA185C93AEE7B
sc_key::key_for_master : 73636B65795F666F725F6D6173746572
sc_key::series_key : 73636B65795F7365726965736B657900
sc_key::series_key2 : 73636B65795F7365726965736B657932

service mode dongle HMAC

46DCEAD317FE45D80923EB97E4956410D4CDB2C2

PS3 PUP HMAC

F491AD94C6811096915FD5D24481AEDCEDEDBE6BE513724DD8F7B691E88A38F4B5162BFBECBE3A62185DD7C94DA2225ADA3FBFCE555B9EA9649829EB30CE8366

• Location: PS3 software update plugin

index.dat Keys

index-dat-key-ps3: 2B7E151628AED2A6ABF7158809CF4F3C
index-dat-iv-ps3: 3032ADFCDE09CFBFF0A3B3525B097FAF

Warning: this is for index.dat format, not EDAT/SDAT nor DOCUMENT.DAT format.

PS3 Minis ISO.BIN.EDAT

How are these keys used? What is the link with PSP klicensee?

ps3minis1:    D6606A6B2499CBDA5FA09081C5CDBD8A (SHA1: F72D80C2386010667F8A75DEB026A011D5ABA570)
ps3minis2:    625E777946626A37336E3A5D4A6B714B (SHA1: C218DAFEC53C8DEAAC9A9E3D2B9C1C6A48371F9F)

aim_spu_module Keys

Observations

Warning: this section should be refactored as names here are from 2011 libeeid code and RE and are outdated because at the time their use was misinterpreted. See zecoxao's ps3-decrypt-tools for updated key names.

• Source 1: here mirror.
• Source 2: here

Ks stands for keyset but was misinterpreted:

aim_ks_1    : 2ED7CE8D1D55454585BF6A3281CD03AF <- EID0 section 0 seed
aim_ks_4    : 30B0395DC5835AAA3A7986B44AFAE684 <- EID0 section 0xA seed

Some keys have yet to be studied:

aim_iv      : 51F78B72A64711CF5C72323FB8607A00 <- magic_iv0 <- ????
aim_key     : 922B198CDF0C07DCCE848B69882D804CC23F19C2EAE1244F35AF176F7FD37851 <- magic_key0 <- ????
aim_compare : 401C4AA63B2C8D44E245F074DAE7782A 360D1E8EE2116BDF6F0D8A3CC17BE38F EA48B571F4D26DED0000000000000000 (1.00-3.42)

aim_compare->magic_0 (note that there is magic_1 and magic_2 also in very old PS3 firmwares)

   aim_spu_module.self.elf 1.00:
  
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  
   00008670  40 1C 4A A6 3B 2C 8D 44 E2 45 F0 74 DA E7 78 2A  @.J¦;,.DâEðtÚçx*   <- compare  (1.00-3.42)
   00008680  36 0D 1E 8E E2 11 6B DF 6F 0D 8A 3C C1 7B E3 8F  6..Žâ.kßo.Š<Á{ã.   <- compare  (1.00-3.42)
   00008690  EA 48 B5 71 F4 D2 6D ED 00 00 00 00 00 00 00 00  êHµqôÒmí........   <- compare  (1.00-3.42)
   000086A0  51 F7 8B 72 A6 47 11 CF 5C 72 32 3F B8 60 7A 00  Q÷‹r¦G.Ï\r2?¸`z.   <- IV    (1.00-3.42 but not found in 3.50++)
   000086B0  92 2B 19 8C DF 0C 07 DC CE 84 8B 69 88 2D 80 4C  ’+.Œß..Ü΄‹iˆ-€L   <- KEY   (1.00-3.42 but not found in 3.50++)
   000086C0  C2 3F 19 C2 EA E1 24 4F 35 AF 17 6F 7F D3 78 51  Â?.Âêá$O5¯.o.ÓxQ   <- KEY   (1.00-3.42 but not found in 3.50++)
   000086D0  2E D7 CE 8D 1D 55 45 45 85 BF 6A 32 81 CD 03 AF  .×Î..UEE…¿j2.Í.¯   <- KS 1  (1.00-3.56)
   000086E0  30 B0 39 5D C5 83 5A AA 3A 79 86 B4 4A FA E6 84  0°9]ŃZª:y†´Júæ„   <- KS 4  (1.00-3.56)

   aim_spu_module.self.elf 3.42:
   
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   00003070  30 B0 39 5D C5 83 5A AA 3A 79 86 B4 4A FA E6 84  0°9]ŃZª:y†´Júæ„   <- KS 4  (1.00-3.56)
   00003080  2E D7 CE 8D 1D 55 45 45 85 BF 6A 32 81 CD 03 AF  .×Î..UEE…¿j2.Í.¯   <- KS 1  (1.00-3.56)
   00003090  92 2B 19 8C DF 0C 07 DC CE 84 8B 69 88 2D 80 4C  ’+.Œß..Ü΄‹iˆ-€L   <- KEY   (1.00-3.42 but not found in 3.50++)
   000030A0  C2 3F 19 C2 EA E1 24 4F 35 AF 17 6F 7F D3 78 51  Â?.Âêá$O5¯.o.ÓxQ   <- KEY   (1.00-3.42 but not found in 3.50++)
   000030B0  51 F7 8B 72 A6 47 11 CF 5C 72 32 3F B8 60 7A 00  Q÷‹r¦G.Ï\r2?¸`z.   <- IV    (1.00-3.42 but not found in 3.50++)
   000030C0  40 1C 4A A6 3B 2C 8D 44 E2 45 F0 74 DA E7 78 2A  @.J¦;,.DâEðtÚçx*   <- compare  (1.00-3.42)
   000030D0  36 0D 1E 8E E2 11 6B DF 6F 0D 8A 3C C1 7B E3 8F  6..Žâ.kßo.Š<Á{ã.   <- compare  (1.00-3.42)
   000030E0  EA 48 B5 71 F4 D2 6D ED 00 00 00 00 00 00 00 00  êHµqôÒmí........   <- compare  (1.00-3.42)

mode_auth_data

This is Product Mode authentication data, stored in Syscon EEPROM.

key         : FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF
iv          : 0123456789ABCDEFFEDCBA9876543210
hmac_key    : 123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037
              F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872F1482EA7EC578872
magic       : 52796F7461726F206973206375746521 (Ryotaro is cute!)

Source

SYSCON_MANAGER_KEY

 D413B89663E1FE9F75143D3BB4565274

• sc_iso_module_1.00-4.00
• source

AACS Keys

aes256ctr_key: 995FE3C3AB857BFCD853F1ABE796799D0E2093B2F7E094AE39CD88A2AC879F96
aes256ctr iv: 802794556C7716719B40A175DB9A455E

[Another decrypted arrays with this key]

magic: FolkloreJam

key: 2DC2DF39420321D0CEF1FE2374029D95
iv: 0BA0F8DDFEA61FB3D8DF9F566A050F78

new magic: CODEFACE

public key 1 enc:

 453C8B51307C4D15621C5D9D23D35BC3CE5F34136825B970130CFCCE0799F03D66004B25CF3EB6E2

public key 1 dec:

 63C21DFFB2B2798A13B58D61166C4E4AAC8A0772137EC638818FD98FA4C30B996728BF4B917F6A27

public key 2 enc:

 5EB2636DE15990A675AF74634DBFD2F48BD9802D7B468C231DADEAC26EB4B82B7EF900EE3193D122

public key 2 dec:

 784CF5C36397A4390406A49F7800C77DE90CB34C001DF36B8F2ECF83CDEE438F7FD1F4806FD20DE7

public key 3 enc:

 26FE96AE82CE349F71A9D0FC35BF158962D533617B5B7F4892832541A35AFBA40128F46E5E41DCC5

public key 3 dec:

 00000000000000000000000000000000000000000000000000000000000000000000000000000000

private key enc:

 05974EA73D2019A1FE03A7F685DCBD5A7D2F07E5BF15DA291B31586C8840C75B

private key dec:

 004FC12D7464FBFB3E0D5754016AE6867A256C16EA

Curve:

p =   9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DF
a =   9DC9D81355ECCEB560BDB09EF9EAE7C479A7D7DC
b =   402DAD3EC1CBCD165248D68E1245E0C4DAACB1D8
N = 009DC9D81355ECCEB560BDC44F54817B2C7F5AB017
Gx =  2E64FC22578351E6F4CCA7EB81D0A4BDC54CCEC6
Gy =  0914A25DD05442889DB455C7F23C9A0707F5CBB9

Second aes-256-ctr_key:

 6634510EF3D58392B8689C487AEC8CF2AC90663B354D580B90FB98FE7DB5C384

Second aes-256-ctr iv:

 BC0D7738D332B780A6F89ED022745F0A

CPRM

Decryption key for obfuscated arrays:

Key: 688D8FECC3AAB50AAE45506B41A48BC3
IV: 6AC5B2F7055C031AE36BA31D285D24E5

Decrypted array 1:

3AD09AB6F5C116B758F6EDE6D98C57FC
FD4B9B470E8EFFF3BBBA0A8015D72B36
6A435A89B45D71198FA088B8E88AC3AE
7C4E3DB596CC21001A6B12DB1FE4119D
D39368B07F3B52B994DDA51B466031EC
C9F8E95E1398BF27560891E36F2040B2
2CCE0210E018D56CDECD8779AFA92650
F233926EC03F3941AA5B7D2403D62FEB
0B99864C51458D2EEF077BE24D7AFE25
5C29A2A8B1F0B3C4307E6338CBF44FD1
DF4432DC175F662A819E774A656734FA
541E14BE04F1A79C8B37EE85AB220F69
C5D40584A47342A164E1708390C2480D
611CC672FB7674E701D8C8D275A3CF28
821D4935C7BDCAA6AC0C62ADF93CEA2D
59DA3E976D09F755E523539F06BC9578

Decrypted array 2:

009153EE3EC7524B0000000000000000

AV CC Multi

942C152C1C2C9D2C94AE15AE1CAE9DAE

Archive keys

FA72CEEF59B4D2989F111913287F51C7 generic key

EA02CEEF5BB4D2998F611910D77F51C6 per-console key

Marlin DRM

DES key/iv? 7563686979616D61 

KeyRing SHA1 Seed? DAAA8CE98DFA1563A5E3E27FBBCF6443

DivX DRM

Key 0678CE0EC45DA9554D2CDA549B91BC1C37D628FBDAB2B095649D4E102A1D1B41

Arcade Master Key

Key 359F59BB8C256B91093A92007203ABB33BADF5AC09A0DC005859D6F159C4F54F
IV 929214D8FCCB4CE7099ACEBDFC6612B9

• used for encrypting Arcade/SYSDB ENCDEC/ATA Seeds
• Location: Lv1Ldr

Arcade ATA Decryption Key

Key: 5F20A21ED12FF6425B62FDE0D1881C8464131BE76B28CE9A
IV: 00000000000000000000000000000000

• algo is aes-192-cbc, used for System 357A (GECR-1100)
• Key forged by encrypting Arcade ATA Seeds with Master Key

Arcade ATA VFLASH Decryption Key

Key: 5F20A21ED12FF6425B62FDE0D1881C84
IV: 00000000000000000000000000000000

• aes-128-cbc
• Used for System 357A (GECR-1100) VFlash.
• Key forged by encrypting Arcade ATA Seeds with Master Key.

Arcade ATA Decryption Key 2

Key 5F20A21ED12FF6425B62FDE0D1881C845F20A21ED12FF6425B62FDE0D1881C84

• Key used for System 369

Arcade EncDec Decryption Key

Key 7B07E0D651130EB443146836DB89B5AB230976E1E842D4F44A5E257615991BA1

• Used for System 369 (VFlash).

SCEI_AD_SIGN AES CBC Master Keys

RIV0: 8ceb482d10befb61871b6407dcfce7a3
KEY0: 3683a2fae5e62fc59004db1911c0562f
RIV1: 08080b7163e4fbabc2905023d430fc92
KEY1: c4b92b1e1fc6429ae63701340336a529

• Location: lv2_kernel.self
• Used for popup ads.
• Those decrypt 2 0x420 (blaze it) blobs inside lv2 kernel.
• Found inside 2 0x40 byte encrypted seeds. Magic SCEI_AD_SIGN inside?
• See code.

SCEI_AD_SIGN RSA Keys (External)

pub : BB75227C7CE52660799A0DF40B4A789B6D74386E86EC14589CD7BAE6E6D883315365639415FB5919E6C015B1CB379D77F4B5AD5DA6B10ACD65DD3E94DC4973596A44F397AE493CF74CDBCD4305C532B9B7FC3F077036F49EBB8D2F9858BB0032470275582D5AE01C7D83A5B082AE58F9EAAF07304C948B1211416F4A13453F61
exponent : 010001
priv :  045EDEC6F8427F7A905B3F28097B5B0484B0C9000AB546642A83FD1F9512473CC72CFDFD5DE5D655FC434E3E2EF6C4FD1EFF7D634997A720D2D72DB65ACC7B9BF7CE79CA35DC9E28693A852B18F935CB1BFF1D6586C40393FECCE5A6E764CCBA30E373F37ACBD6FE154E54D658130F6A12C993D5C8CF44995332C417BB687361
p: F551D70C7104CFD27F8A543E1DE89ECCF1173062D81B509382E7E99A6EFFE046AC6C1E9FA277C3E0A92AE3C1C81D8B28EE56C83AF307733324D287DD555DE3E3
q: C39E677C8DE1E8F3502D8D85E31E75B6DD4EB567952B54F6B7D3703EBE386C7CC1D9E24AD8BD482452EFDA9D7CAD094539633300A26C0501CE42CADC12501AEB
dp: 3CA10659FFD0A5A02B7F3F84BE959031AC6003C85A0A9E2666D2F42C03C4DF63F8171C966D6BD6103F1EE77D2BFD09388B770D336C7EE9DCB8FC0332137809EB
dq: 3EB4B857A4E395D8E90AB12309FAE9A104B006567DEAB601A04B96DF85FA704C4D979A828397A9587B7D87869440A3881D2D3F5C24B49BA64888009F2AFFA2A1
invdp: E8DD3C07131550C4093A36D1C8DF108786C97F5628244CF3F60BF1437FC939659B0A9956412742AE2A3FF7BD82D7901B21A90FD20FCA5A92DBF4C1FDD7CD8CD3

• Location: lv2_kernel.self
• Used for popup ads.

SCEI_AD_SIGN RSA Keys (Internal)

pub : 81CB2FEFB597AB59D7374B2897931501229DBDE307151C20082623C8AA82F5DAD7EB0AE836132E3609D70EAB6E0256DB90634CEECF889B83BCB3383BBA73B320C95BBDEAFD8DA7C3DBBB8231313C82F607CC1E7036BA4A5D60E7AB3F41983249F8096EA1232053D8D185DBB43088EBDD6264BB5F609CF2389229CAF2634385FF
exponent : 010001
priv :  03AEC3B3EDF7993589DD38453513C7C749F7A6D11FBCD218F8923876B39BD6A4F876634F566571ECB797C2034C3245CBA20BA73DA966CB5ED00657C49E14355360F200549A657782C0EC5222F680F4815276796CB3F6C20074F9F5F1C45DCB1114BCA83A23FE8C34D6F73AF5B19A83D0AC60FFE09FCC8E13AB52D6FD5206AB49
p: A7C32A8796127FF2DB879B17481F87BD0C37A3F0D66DF3F84BED83F7B753566420C08D4A28B92588385E05C43AD0387B2A9F99AB41B3B846EE4EE6FDDE5B6DA9
q: C60F9FA06E2604BFA9CDBE093BA89434C9C55E0B440319DBD398360C3AD3039082FF3B211E3D9396715BE2C0511B48DE708923F548AB6DD0AE7459D942118F67
dp: 3A2568094497B6E73AF5BE688C63F94D29FDE301A7A0C68DC9EB51F13B06548C31D9EB5EC7CC9C58A188DD20CD6DBC15DC8922DEFBCFC9D033EAFF1F00C1D9B9
dq: 17E0B850E216A949E611CCD05625EBC035771AF066C1ACF3689E181DFF55833F7FDB7F686DB9E4BA256E7B76CE106907902FA86B20D8B2038F94AD6458E7BF0F
invdp: 48A78458DCA3827D6BA22152B77913E590DA30978B9DB25048C4D45C74B7B375739C39C77CF2F4828DC4483F2A89EA5E3842CC96D9906FBB5E1C52E11B0962DE

• Location: lv2_kernel.self
• Used for popup ads.

Trophy RSA Keys

pub : CA30CEE59BF19E041F6F02C54AE42CD6769185E157AB8659B70DCEC0C3EE6039FF952FD9767D35474B11BB5514205C553864F77BD4DA899B30110B0EA4F8AD33FBE0350E085B2A92A7D327978110AAB95085730235408156707C3B2238F978BFF4F308063809AEAFB2F9AEC62E1968CFF58B9BA834B3588C92C8411C548BFC49
exponent : 010001
trns_pub : CE8A7F561F08EC50EAD12C1CD5EA95F914574E52942E1D25D944319704ADC3E87FDE0E0451EDA05C347BBA584E7572F9660D18014E444C46C8EE8ADF10F4A1345FE51EF42D94A1A9DE692CE99702AAC4D4C5E528EFADBA5B53B20A50B686D084307EC3EABB61157E5E00A96A374FBF5C570B804D821C17573C1C00ACF29CF5E7
SceNpTrophyXmlShaHmacKey : 6AC0B3FB1EBB4FB7BCC2A00DA3A2A4BDBCB788EC456748CC86CD9D09EF37937F6EE31167778E414E9B711BE9D8CBB5F8956E454EE94A46C39DC4FF0D090B92B7

• Location: np_trophy_util.sprx

CFK1 Master Keys

INTERNAL_KEY0: 43464b31303132333435363738393a3b3c3d3e3f404142431a643e8a7af5091136a7749cedf481ef0aff55cde122f9c47e1c94f082536a1f244b9a9ce08da5e8
INTERNAL_KEY1: 2b7e151628aed2a6abf7158809cf4f3c14d5fa4317d81dc5b144afcd06773f3daabe101959c477a164d31f08a51652862cd3e6efa98e49cd2a4f13380e5d897d
EXTERNAL_KEY0: 43464b31e80749ef395734ad4d592952a15c72255e4ebdf6fb2b7a7e9cb2cfd4bbe145a325ce53afb978047edd426df7d9e97c8ce02e7c2215013d9f9870e5da
EXTERNAL_KEY1: 7bddd39f9b2c22af82669e340adea35bf6c9b64d53fd6d8baf42ed64086cb4a7d8ff0ac1861eb27b7959c1e5e5278b05daf775c8bae7a47ce9a81e83da08ea6e
NEW_EXTERNAL_KEY0: 43464b31136ae3119c9b783d35d6db6c6744a816d6815b8849e69651828d7e0b7e0a75a6a9a22bae2f91b521c2e07cca5b3cc8d7ca63eb0b7298b23d26640185
NEW_EXTERNAL_KEY1: d6ed26424c55c55994b586335d9254d355202a1200eef1b5d65661020ec8feffb14f8b47667bdfc0612328527d525b1973f9f1e1f8bfec7bb87db94c0d8b933c

• Location: lv2_kernel.self
• Added in PS3 FW 3.10. Seems to be Cinavia related?

PME Vectors

reset    external decrem   syscall
482D2D34 482A4F70 482A509C 482A50E4 <- internal
48202658 482023D0 482024FC 48202544 <- external
48079C94 4806E624 4806E750 4806E798 <- mambo_internal

• these denote the location of several things inside lv1. TOC is in the third entry

SYSCON Keys

• Note: The SYSCON Slot Keys are all used on later models of SherWood up until 0x1D slot
• The other keys are also used, available on the arm firmware
• The only difference is in the generation of the patch keys

78K0R ID

3A 4E 6F 74 3A 55 73 65 64 3A

• :Not:Used:

GARBAGE Key

C8979F5726F6A130CB9309A2F7AA0C84

• Used in conjunction with factory init key.
• Encrypt 16 FFs with this key for n times, where n is offset of EEPROM / 16.
• exists on slims!

EID1 Keys

0x0 Master Key

A46BA2B83D4E7EE559F239E0087A3808

• Decrypts magic value at EEPROM offset 0, or at 0x70000 on AA rom, or at 0xB0000 on BB/CC rom (size 0x10) which is SC INITIALIZATION STATUS, where 01 means UNINITIALIZED and 02 means INITIALIZED.
• This crypto is also valid for PS3 SLIMs SW2 !

0x10 Master Key

5794BC8C2131B1E3E7EC61EF14C32EB5

• AES128CMAC key to sign EID1 from 0 to 0x280.
• Resulting CMAC digest is compared to the one in EID1 at offset 0x290.
• AES128CBC key to decrypt EID1 second flash layer.
• 0x160 bytes of keys and a padding of zeroes present inside decrypted EID1.
• This crypto is also valid for PS3 SLIMs SW2 !

0x20 Master Key

88228B0F92C4C36AF097F1FE948D27CE

• AES128CMAC key to sign EID1 from 0x10 to 0x290 (the area covered in BB chip is 0xB0010 to 0xB0290 but CMAC mismatch).
• Resulting CMAC digest is compared to the one in EID1 at offset 0x2A0.
• AES128CBC key to decrypt EID1 EEPROM layer.
• 0x160 bytes of keys and a padding of zeroes present inside decrypted EID1.
• This crypto is also valid for PS3 SLIMs SW2 !
• On slims, AUTH1 seeds from sessions 1 to 6 are missing inside BB/CC chip data

0x40 Master Key

48FF6BFA9C172C6E14AE444419CAF676

• Used to obtain data at EID1 offsets 0x2A0, 0x2B0, 0x2C0, 0x2D0 if keyseed at decrypted EID1 offset 0 is encrypted, once, twice, three or four times, depending on the offset count + 0x10 starting from EID1 offset 0x2A0.
• Also used to obtain data at 0x2E0, 0x300, 0x320, 0x340 (if data at EID1 offset 0x2A0 is 00...01, use encrypted keyseed once).
• CMAC data at 0x2E0 with key encrypted once and if it matches with data at 0x2F0 decrypt, same with 0x300/0x310, 0x320/0x330, 0x340/0x350.
• This crypto is also valid for PS3 SLIMs SW2 !

SNVS Keys

0x30 Master Key

A09631B4F8AFC77780CB6C9EEB0870FC

• Used to decrypt SNVS.
• Encrypt keyseed at EID1 offset 0x150 once for section 0, twice for 1, etc, up to 8 times for section 7.
• Decrypted regions are with initial byte xored with 0x00 for first 0x10 bytes, 0x01 for second 0x10 bytes, etc, until 0x40 times per section, for a maximum counter of 0x3F.
• This crypto is also valid for PS3 SLIMs SW2 !

AUTH Keys

0x110 Master Key

A3ADB99A21E47ADFF3FD7FC3173981CA

• BE_SC
• This crypto is also valid for PS3 SLIMs SW2 !

0x120 Master Key

6933CEE7A518E5B8CBE1FC14B261B765

• SC_BE
• This crypto is also valid for PS3 SLIMs SW2 !

0x130 Master Key

1762C80CA86683B7E76FE3853CCFE5DB

• XOR with 2 keys to obtain SC2TB and TB2SC Keys.
• This crypto is also valid for PS3 SLIMs SW2 !

Fixed Auth1 Response

3350BD7820345C29056A223BA220B323

• 0x45B8
• exists on slims!

Fixed Auth2 Response

3C4689E97EDF5A86C6F174888D6085CF

• 0x45C8
• exists on slims!

SC2TB Key

71F03F184C01C5EBC3F6A22A42BA9525

• (0x130 xor 0x4578)

TB2SC Key

907E730F4D4E0A0B7B75F030EB1D9D36

• (0x130 xor 0x4588)

secure_com_lib_internal_key::session_key_create_key

9F1DF816BB4A4A0129D031CFB0AD9B30 0x50 Master Key
D302FDE17578FBDBA1058449BA5C1BEA 0x60 Master Key
0E6B7480E5CEB2562A3347BB41012455 0x70 Master Key
7910AC5D2AD16001F6A2783979096103 0x80 Master Key
E3052804B7D2836F2879A1751BB40D48 0x90 Master Key
EF586F9D599170676850590BA67D4BC7 0xA0 Master Key
5D9598637AF25F8023623B1268B5131A 0xB0 Master Key
0EAA32140A2861D8659626F6CE2286DB 0xC0 Master Key

• This crypto is also valid for PS3 SLIMs SW2 !

AUTH1 Related Key

C50A57BEC9F2A2EE1C4478526EE24B88

• 45A8
• exists on slims!

AUTH2 Related Key

2B1072970A7576D8E59803977FF2E459

• 4598
• exists on slims! twice!

TIME Key

secure_com_lib_internal_key::time_key

E3EFDE987E4A2D3F8CF7B3B60E846B21 0x00 0x110 seed with 0xD0 keyvault key
4AB026664E9D02F53EFF9544549B1F97 0x01 0x120 seed with 0xE0 keyvault key
7ECA7F299891F1B243119E35AE94C3DE 0x02 0x130 seed with 0xF0 keyvault key
E0B7A0867CF44923BAE65E3386460C80 0x03 0x140 seed with 0x100 keyvault key

EPROM Keys

0x150 Master Key

8CD72FD3E1E537CB51D6F1FEEEB5CE4C

• used with master key 0x1D0
• used with master key 0x190
• used for rtc clock correction
• exists on slims !

0x160 Master Key

DED8B76BF948E396BDCF74F1DE1C64E4  

• encrypts 0x2710
• exists on slims !

0x170 Master Key

7AB230EAD7DD151695878AEBB20812BC

• encrypts 0x2760
• exists on slims!

0x180 Master Key

210623DCA298994DFE87F840FC481CBF  

• encrypts 0x2790
• exists on slims!

0x190 Master Key

7073147F753089CC7256D37113032E3C

• decrypts 0x26B0, 0x26E0, 0x26F0
• exists on slims!

0x1A0 Master Key

A8DF3DBB4D0B526A0EAE3039C6A04F90

• decrypts 0x26C0
• exists on slims!

0x1B0 Master Key

259A8A939591C7D11CBA8682EEC7D50E

• decrypts 0x26D0
• exists on slims!

0x1D0 Master Key

179C503127A8E8F594437B1C108357A7

• decrypts 0x2700 / 0xB2700 on slims
• This crypto is also valid for PS3 SLIMs SW2 !

FULL Keys

CIPHER ENC

428D643E54C76BAED8428907B1952FC7

• exists on slims!

HASHER ENC

E6AF3DCEAA1F4185D344CBCEDCBC280F

• exists on slims!

MASTER

97DAAC1F9640F576A53ECE93C92B17F2

• exists on slims!

CIPHER KEY

160374F159B744C97F2CF2DD3EEE599D

HASHER KEY

3E0020AEF88FF50D693B6521E2A1C4F3

PTCH Keys

MASTER

5E7CD16A78443928120688D7883493F1

• exists on slims!

0x140 Master Key

0B3C10FF47FC9D3437CA80952CAE9170 

• PTCH xor key

PTCH CIPHER XOR

D6DD7D29B4F55B318091821CF7C84A3C

• exists on slims!

PTCH HASHER XOR

1828374D624774AF0144535DE54FF10F 

• exists on slims!

COK-001 body key

C1D5D39BBC56839E95AB842233FF1C59

COK-001 hasher key

FDFCE3EB57BAE13A39B127BB3226DA14

COK-002 body key

C9D03C410A120F66E4F4A96ADAF5ADAA

COK-002 hasher key

746D66511105D0DB54BF3EDFAD275EAC

SEM-001 body key

D484266DB6C3AE16B1B82DDBBBF99479

SEM-001 hasher key

7843E32BA18B34355436C2F657F41F16

DIA-001 body key

0121F8AB75898AD2C58D3546B7D8F72E

DIA-001 hasher key

310068E416324779C32C47D32B39CAB5

DIA-002/DEB-001 body key

6B3583DA1AA6B49106E1641178EE68C8

DIA-002 hasher key

6E9CE7C57BFC27CDD59A05093ADFE475

PROTO BOARD 1 body key

F790F953D734AC5D7C78EE498B98CE48

PROTO BOARD 1 hasher key

C5E30C6393A1EE315E3F9BCA4CF275B0

PROTO BOARD 2 body key

881AE6022FAEDDE0FABC01DFFABAE140

PROTO BOARD 2 hasher key

A40B57FB1BCB160F99F9F126B8477D1C

DYN-001 body key

C4AB610A03B98A9B9E52FEF972967523

DYN-001 hasher key

B80A6FE26686C4F119AD76901D431494

Modules

Notes

• In CEB Ebootroms, Sony uses the same 256bits keysets for self/rvk (lv0 uses lv1 keyset) than the ones initially available until 3.30 with a broken aes256ctr (yes, they use a 256bit key)
• With Ebootroms themselves, only the first half is used on ceb2010-2060 ebootroms
• Likewise, the individual_info erk is 256 bit size, but only first half is used.

A '-' means that the cell is empty, because the version does not matter or the private key cannot be calculated (see 3.56 and later below) like has been done in 3.55 and earlier. See also: https://web.archive.org/web/20130425164335/http://www.mhlavac.info/wp-content/uploads/downloads/2010/03/lec2.pdf

• <= 3.55:
  • Randomfail present, thus when private key is unknown: use scekrit ;
  • No obfuscation added to loaders yet, thus keytable as seen inside loader are the keys used by crypto engine (in SPU, or key as used by en/decryption tools like scetool)
• 3.56:
  • Fixed the randomfail in 3.56 and later after the fail0verflow presentation at 27C3, thus scekrit is of no use, see also: [2] ;
  • No obfuscation added to loaders yet
• =>3.60:
  • fixed the randomfail since 3.56, thus scekrit is of no use ;
  • Obfuscation of keytable was added since 3.60 see Key Scrambling, which used ch72 ringbuffer seed for deobfuscation.
    • "dec" in ldr table refers to the deobfuscated key as used by crypto engine ;
    • "enc" in ldr table refers to the obfuscated key as seen directly inside the decrypted loader keytable

Lv0Ldr

lv0ldr

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
-  SD	FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF	0123456789ABCDEFFEDCBA9876543210	123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872	000000000000000000000000000000000001000000	0x27
030.001~050.013  CEB	B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222	B43661B9A79BAD9D8E2B046469CDA1E7	4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20	002CC736C7AD06D264E9AB663EB1F35F5DC159248C	0x33
0.60~4.91	CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A	F9205F46F6021697E670F13DFA726212	A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D	001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3	0x33

MetLdr

metldr

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
-  SD	FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF	0123456789ABCDEFFEDCBA9876543210	123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872	000000000000000000000000000000000001000000	0x27
-	C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B	47EE7454E4774CC9B8960C7B59F4C14D	C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019	00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670	0x20

Lv1ldr

lv1ldr

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
0.80  SD	FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF	0123456789ABCDEFFEDCBA9876543210	123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872	000000000000000000000000000000000001000000	0x27
0.80  SD ~3.31	014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011	A17D6A522CB1B08F97DA8A82E97C12F7	72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573	008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8	0x11
030.001~3.31	B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222	B43661B9A79BAD9D8E2B046469CDA1E7	4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20	002CC736C7AD06D264E9AB663EB1F35F5DC159248C	0x33
3.40~3.42	B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646	A79B05D4E37B8117A95E6E7C14FB640E	7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375	00033A699FDD2DA6CDD6CCC03B2C6145F998706F74	0x34
3.50	1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7	E034D31A80316960024D1B3D3164FDC3	7E3A196f4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398	005815D17125D04C33790321DE29EB6241365100B5	0x35
3.55	53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23	44E652661AC7584DBE08ECB810FB5FC0	733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9	004312C65347ACBE95CC306442FEFD0AF4C2935EB3	0x05
3.56	48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83	15DCF3C67147A45D09DE7521EECA07A1	85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C		0x07
3.60~3.61	5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5	DF0F50EC3C4743C5B17839D7B49F24A4	1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E		0x05
3.65~3.66	BD0621FA19383C3C72ECBC3B008F1CD55FFD7C3BB7510BF11AD0CF0FC2B70951	569AF3745E1E02E3E288273CDE244CD8	21E26F11C2D69478609DD1BD278CDFC940D90386455BA52FCD1FA7E27AC2AFA826C79A10193B625C		0x07
3.70~3.74	41A6E0039041E9D8AAF4EF2F2A2971248EDBD96A3985611ED7B4CE73EE4804FE	C8C98D5A5CE23AF5607A352AECACB0DC	4389664390265F96C1A882374C0F856364E33DB09BE124A4666F9A12F0DD9C811EDD55BA21ED0667		0x12
4.00~4.11	557EDF6C063F3272B0D44EEC12F418DA774815B5415597CC5F75C21E048BAD74	7144D7574937818517826227EF4AC0B4	085D38DBF9B757329EB862107929909D32FA1DAE60641BF4AC25319D7650597EE977F8E810FEEA96		0x13
4.20~4.91	10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD	ED8699562C6AC65204FA166257E7FCF4	9AF86FC869C159FBB62F7D9674EE257ABF12E5A96D5875B4AA73C13C2BC13E2A4079F98B9B935EE2		0x14

Lv2Ldr

lv2ldr

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
0.80  SD ~3.31	014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011	A17D6A522CB1B08F97DA8A82E97C12F7	72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573	008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8	0x11
030.001~3.31	94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F	9769BFD187B90990AE5FEA4E110B9CF5	AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D	0070ABF9361B02291829D479F56AB248203CD3EB46	0x20
3.40~3.42	575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10	411CB18F460CE50CAF2C426D8F0D93C8	3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA	0073076441A08CD179E5FACE349B86DA58B5B7BA78	0x21
3.50	6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68	603A36213708520ED5D745DEC1325BA5	5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3	0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD	0x22
3.55	84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17	5B240444D645F2038118F97FD5A145D5	B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72	009D4CBA2BFB1A8330D3E20E59D281D476D231C73A	0x32
3.56	EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359	9CA9282DC7FA9F315EF3156D970B7CD4	0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699		0x33
3.60~3.61	88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC	8D18E8E525230E63DE10291C9DD615BF	86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027		0x32
3.65~3.66	688D5FCAC6F4EA35AC6AC79B10506007286131EE038116DB8AA2C0B0340D9FB0	75E0239D18B0B669EAE650972F99726B	008E1C820AC567D1BFB8FE3CC6AD2E1845A1D1B19ED2E18B18CA34A8D28A83EC60C63859CDB3DACA		0x33
3.70~3.74	E81C5B04C29FB079A4A2687A39D4EA97BFB49D80EF546CEB292979A5F77A6254	15058FA7F2CAD7C528B5F605F6444EB0	438D0E5C1E7AFB18234DB6867472FF5F52B750F30C379C7DD1EE0FD23E417B3EA819CC01BAC480ED		0x11
4.00~4.11	A1E4B86ED02BF7F1372A2C73FE02BC738907EB37CE3BA605FE783C999FAFDB97	BBE7799B9A37CB272E386618FDFD4AEC	5B31A8E2A663EBD673196E2E1022E0D64988C4E1BBFE5E474415883A3BA0D9C562A2BE9C30E9B4A8		0x07
4.20~4.91	0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03	9B79374722AD888EB6A35A2DF25A8B3E	1034A6F98AF6625CC3E3604B59B971CA617DF337538D2179EBB22F3BDC9D0C6DA56BA7DDFD205A50		0x14

IsoLdr

isoldr

Version	Revision	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
0.80  SD ~3.31	0x01	9E85BEE6D39E9632A77FE3CD6E647C8DFE4606C383E1697DD6D9CE63341EAFF9	2C1F4C82FF3A796D3A772CEEF010ECA4	625D1DF4C3264BBA9FC17A4437BA42591585A5ECCC6F3042DB3A80CBBC0426DAF33549C537AA7782	00D19A1B338041F7C31062B9C40E725E1DA5D7C11A	0x20
0.60~3.31	0x01	8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4	C82D015D46CF152F1DD0C16F18B5B1E5	733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29	009BE892E122A5C943C1BB7403A67318AA9E1B286F	0x36
3.40~3.42	0x01	101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D	8D2E9C6297B8AD252998458296AC773C	138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625	00849DBC57D3B92F01864E6E82EB4EF0EF6311E122	0x32
3.50	0x01	3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843	A414AC1DB7987E43777651B330B899E1	1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F	0085B4B05DEBA7E6AD831653C974D95149803BB272	0x33
3.55	0x01	BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37	0207A479B1574F8E7F697528F05D5435	917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58	00294411363290975BA551336D3965D88AF029A17B	0x03
3.56	0x01	311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE	7BB8B3F5AC8E0890E3148AE5688C7350	3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD		0x08
3.60~3.61	0x01	8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093	FFF9CACCC4129125CAFB240F419E5F39	098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556		0x03
3.65~3.66	0x01	E6A21C599B75696C169EC02582BDA74A776134A6E05108EA701EC0CA2AC03592	D292A7BD57C0BB2EABBCA1252FA9EDEF	2ED078A13DC4617EB550AD06E228C83C142A2D588EB5E729402D18038A14842FD65B277DCAD225A5		0x08
3.70~3.74	0x01	072D3A5C3BDB0D674DE209381432B20414BC9BDA0F583ECB94BD9A134176DD51	8516A81F02CF938740498A406C880871	5A778DEB5C4F12E8D48E06A2BBBBE3C90FA8C6C47DF9BDB5697FD4A8EB7941CE3F59A557E81C787D		0x21
3.70~3.74	0x0100	786FAB8A0B89474A2CB80B3EA104CCCB9E13F66B45EC499BB31865D07C661EA8	94662F13D99A9F5D211C979FFDF65FE3	912C94C252B7799CEB45DFBB73EF7CAD9BCC0793A3331BBB79E3C47C0F5C782F698065A8D4DB0D8B		0x0E
4.00~4.11	0x01	4262657A3185D9480F82C8BD2F81766FCC2C8FD7DD5EBE8657B00B939E0C75BD	4F1E3EF07D893A4714B1B3D5A4E50479	4DBFCFA68B52F1D66E09AFA6C18EC65479EDBD027B6B8C6A5D85FE5C84D43EA40CEF1672078A0702		0x11
4.00~4.11	0x0100	16AA7D7C35399E2B1BFAF68CD19D7512A7855029C08BECC4CC3F035DF7F9C70B	0E50DB6D937D262CB0499136852FCB80	AEE2795BF295662A50DFAFE70D1B0B6F0A2EBB211E1323A275FC6E2D13BE4F2F10CA34784F4CF1EC		0x0F
4.20~4.91	0x01	63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086	953F6A99891B4739358F5363A00C08B9	26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612		0x15
4.20~4.91	0x0100	B96EA32CB96EA32DB96EA32CB96EA32CB96EA32CB96EA32DB96EA32CB96EA32C	B96EA32CB96EA32DB96EA32DB96EA32C	2D7066E68C6AC3373B1346FD76FE7D18A207C811500E65D85DB57BC4A27AD78F59FD53F38F50E151		0x02

Spp verifier

spp_verifier

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
-  SD	FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF	0123456789ABCDEFFEDCBA9876543210	123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872	000000000000000000000000000000000001000000	0x27
0.80~3.55	56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A	007E6B268EF1E986D10A9889CF93A8CB	265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A	0001608EF3BACAFFB8C3A5958A24F758325B62B08C	0x22
3.56	7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0	B889290922B002F57086B818A8FDE3CC	71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63		0x22
3.60~3.61	ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2	3E05572881C5BC845D310EAC28497B08	504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E		0x13
3.65~3.66	E750FE8ED144D99782AC605944350B9F41AE489C3274C42C1BFD5AB06115C7C4	0F23BBED0473B4899AD793AC76D8F722	934861FF0D4BAF7141B658D1D84441D413060D7E534E99E357B5090EECFB34D947694ADB9F6E7D3F		0x22
3.70~3.74	4B1A459AF1D484DABD727BD316351A9A1B3404E9B1DE925B95527166DB3BB2D0	3B6203C2730D283F978A12D5390DD747	0AEEB187EA76913765A15A435F2F1B15545F60794FB5244DC54801B6BABD497565ED6BF57C1A80C8		0x23
4.00~4.11	11FA6344E869787209E6806E66A7799F7128BD98AEAE95B386D4C88EDDDB3FEF	67B49380C74FFB15AD929E8C819586AD	5E028AC83D1BF838CEC43CA11969C72533A057BB0C3CB4A571F8E08DD5DF793CD1E1270CA6E89FB3		0x04
4.20~4.91	D2961BBFFEDAEE269B061454D6ACF262CD71BC6F5320180F0A04A07583CCF7C5	6D308B59BC9054B12C833359D31BAE77	0CDD0D1541A6B0DFD12E951578536CA60C93853B88FCE17592DC8D134B08A94AF8BB08667E2D70A5		0x07

RvkLdr

rvklist

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
-  SD	FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF	0123456789ABCDEFFEDCBA9876543210	123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872	000000000000000000000000000000000001000000	0x27
030.001~3.55	03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF	8B5D7876F40A9E1E9AC2B22F51B60BDF	9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7	00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF	0x29
3.56	22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE	D5D4B8ED62B6CCA0249A79776E136975	51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B		0x32
3.60~3.61	BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3	B20A23079516205525683D8058379CBF	9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6		0x33
3.65~3.66	1EBD693BD813ADDA2203DAEE0441F4146C174F68F532B3E43A48F029230EF70C	501819323BFCF9FB99396B46B70A97E7	6563EA3D5694A913F24059A57B2A3645C7C8A587CF20075EFD978A048CAD7A68A8EB7E6BC4BC5448		0x30
3.70~3.74	4AF39F7A4E214ECB270416EDD17113A23DC5AD2EDAA5FC91817EE171CDB8B9F4	0E5CB28FA2666E3ED45289DABC67DDC2	758BBF611ED6BB8C32D2A49A7AD456D585D11C74926F977737EE309F213D971404A8F9022B409371		0x31
4.00~4.11	99E8959A4363BE9EBDBC2B9C73BCBBE627BF112883E650E3F95879C0BFFB103E	182CC801794A2F7027BB76D29D598550	6319A4B7D99FD3A3332CB13F3DE44A898B6A4CF04B9C15E6166AFC7C5272AF7A4DE04E802FD2C71C		0x02
4.20~4.91	695984b7ee2ec2f77fcc3120150dce7e4480d84480ddd8c5940aeb6f79e63d17	a8ba3e4e63b2bb06fc0ce57e3bb8fc46	7f1950c6e497e922400586ee338b41e01c906c5a6dfd75feb5249cfa4bec534f5ca679670a452b2a		0x12

Spu Pkg Rvk Verifier

spu_pkg_rvk_verifier

Version	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
-  SD	FEDCBA98765432100123456789ABCDEFFEDCBA98765432100123456789ABCDEF	0123456789ABCDEFFEDCBA9876543210	123DA14B3D21D82AFC759A9CF6F41610A24EC8704306BAC4E0941A5B70EEA037F1482EA7EC578872	000000000000000000000000000000000001000000	0x27
0.60~3.55 (pkg)	A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031	4ACEF01224FBEEDF8245F8FF10211E6E	41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13	00542D46E7B3DAAC8AEB81E533873AABD6D74BB710	0x23
3.56~4.91 (spkg)	F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD	59D28DB4ADDFB40B7D768BC9667C67B1	5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0		0x17

Updater (CEB units Ebootroms)

Although these keysets are using 256 bits ERK, the algorithm used for the decryption is AES128CTR therefore only the first 16bytes of the ERK are used (ERK are truncated).

Module	Version	ERK	RIV
updater	E/rXXX	D9580C4D6349692159CDDFC33F53908B	CB445249CE6A9FEB01DF02C7B94938E1
updater	I	99817C618D61549DDDEA247E57788920	E5EA482810A63CF1D29347D3092E6B90
individual_info	E/rXXX	987C95CC38C286D0E36252B867BCEBA1	1AAEBF3ED6EB1B295DAC75963DB37651
individual_info	I	D0BE92DE84F83A26DE1E670683066243	???

toolupdatedec (Communication Processor Updater binary)

Module	Target	Filename	ERK	RIV
toolupdatedec	TCP510/TCP520	reftool_cp_xxx.bin	E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F	File dependant (the first 16 bytes of the file)
toolupdatedec	DTP-T1000	psptoolupdate.bin	A400C48628A7A5294D11AE3BB2587AEA32E501C63E49D1DCAA19B5AEB092F3DB	File dependant (the first 16 bytes of the file)

NID generation suffixes

• The algorithm is sha1(name + suffix).

PS3 NONAME suffix

"0xbc5eba9e042504905b64274994d9c41f"

• Note that this ASCII string is used but not the hexadecimal value for it.

PS3 default suffix

6759659904250490566427499489741A

• Note that this hexadecimal value is used but not the ASCII string for it.

Bluray Drive Keys

• These keys were retrieved from bluray drive firmware.

 5BCE24712335AF70E570F6559A29F34DE7BBC42D97DE7554CE0264E41CA3171F
 97EC3F4F8751F22B7FFCACA83803EAF7

or

 E7BBC42D97DE7554CE0264E41CA3171F97EC3F4F8751F22B7FFCACA83803EAF7
 5BCE24712335AF70E570F6559A29F34D

• Bluray drive firmware uses same curve as KIRK commands 0xC, 0xD, 0x10 and 0x11.
• Signature is at the bottom of the firmware (offset 0x7FD0).
• The algorithm is highly likely to be AES256CBC.

XOR stream for descramble some encrypted areas inside bluray eeprom: http://pastebin.com/71Jx1hnE

It can be used to decrypt emboot and another perdevice areas.

EID0 Sections Keys

Section 0

Public key: 94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A

Curve:

A34D0C98B2A8DEA81E7C3FF0757C5B89
1B8523E1A34D0C98B2A8DEA81E7C3FF0
757C5B891B8523DE929F2B86E0F6525F
FDC819D76D5F139A2F8A49B300A34D0C
98B2A8DEA81E7CEC7E21A8FF20DC9B8F
AF755FD420216829E389548D397246E6
6DF2EC4B7C9B308B62B9CEFFA3F0071A
5C396F67FCE4A3A683

Curve sha1: 9035B33F58DFAEF389FD49187F93C4FC2D2DD268

• Source: sha1 in naehrwert's tweet (2013)

Section 6

Same ECDSA public key and curve as PSP section 1.

Public key: 06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE

Curve: type 2 (vsh)

Section 0xA

Same ECDSA public key and curve as PSP section 5.

Public key: 4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A

Curve: type 2 (vsh)

Appldr

selftype	version	revision	fw	ERK	RIV	PUBLIC	PRIVATE	CURVE_TYPE
app  SD	0.60~0.84	0x00	0.60++	014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011	A17D6A522CB1B08F97DA8A82E97C12F7	72C1034FC8E4C1707B7147B9E930FA3F28EBFE070B5EBFBAE4A666B498050929815CF727C6264573	008732ACD0889FF7480C5C7D9A5D3BF43C46F220F8	0x11
seven  SD	?	0x00	?	BBDF2959EB4AAEF5882BE11FF033B77FF9FD55B1F30819D42154F6B069C14FEF	241C0CC5A8591B50EF460EE3E50116C3	0E140FBAD23F1B236C6AD0623A7C2C6366AEDA66380860A9D727A56FD681F644EF22A7E07979A1BE		0x33
app	0.60~0.84	0x00	0.60++	95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04	4A0955D946DB70D691A640BB7FAECC4C	6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343	006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4	0x21
app	0.84~3.31	0x01	0.84++	79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB	6F0F25E1C8C4B7AE70DF968B04521DDA	94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526	003DE80167D2F0E9D30F2145144A558D1174F5410C	0x11
seven	0.84~3.31	0x00	=>0.84 <=3.31	D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085	DC01280A6E46BC674B81A7E8801EBE6E	A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4		0x11
npdrm	0.85~2.36	0x00 np	0.85++	8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86	7AAECC60AD12AED90C348D8C11D2BED5	05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440		0x0A
app	0.90~2.36	0x02	0.90++	4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A	90C127A9B43BA9D8E89FE6529E25206F	8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E	00530446451C568968EBF7068B1F45C252D70EC942	0x13
npdrm	0.91~2.36	0x01 np	0.91++	F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B	A551CCB4A42C37A734A2B4F9657D5540	B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF	00040AB47509BED04BD96521AD1B365B86BF620A98	0x11
app	2.40~3.31	0x03	2.40++	C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E	E0908163F457576440466ACAA443AE7C	50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92		0x0B
npdrm	2.40~3.31	0x03 np	2.40++	1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664	E31E206FBB8AEA27FAB0D9A2FFB6B62F	3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D		0x08
app	3.40~3.42	0x04	3.40++	838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA	7FDBB2E924D182BB0D69844ADC4ECA5B	1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69	0074E922FDEE5DC4CDF22FC8D7986477F813400860	0x14
app	3.40~3.42	0x05	3.40++	C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC	15D3F191295C94B09B71EBDE088A187A	B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7		0x15
app	3.40~3.42	0x06	3.40++	6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41	24BD1C19D2A8286B8ACE39E4A37801C2	71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95		0x2C
seven	3.40~3.42	0x00	=>3.40 <=3.42	B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E	86F56F9E5DE513894874B8BA253334B1	B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5		0x12
npdrm	3.40~3.42	0x04 np	3.40++	BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706	ADF7B207A15AC601110E61DDFC210AF6	9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30	00B61A91DF4AB6A9F142C326BA9592B5265DA88856	0x16
npdrm	3.40~3.42	0x06 np	3.40++	8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020	05719DF1B1D0306C03910ADDCE4AF887	2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E		0x29
app	3.50	0x07	3.50++	945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55	1D5EFBE7C5D34AD60F9FBC46A5977FCE	AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD	002CF896D35DB871D0E6A252E799876A70D043C23E	0x15
app	3.50	0x08	3.50++	2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13	5A4CEFD5A9C3C093D0B9352376D19405	6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5		0x16
app	3.50	0x09	3.50++	F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B	F4D535069301EE888CC2A852DB654461	1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99		0x2D
seven	3.50	0x00	3.50 only	8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6	908A75754E521EAC2F5A4889C6D7B72D	91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B		0x13
npdrm	3.50	0x07 np	3.50++	3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3	E4897BE553AE025CDCBF2B15D1C9234E	A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E	009EF86907782A318D4CC3617EBACE2480E73A46F6	0x17
npdrm	3.50	0x09 np	3.50++	0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A	04AD3C2F122A3B35E804850CAD142C6D	A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0		0x2A
app	3.55	0x0A	3.55+	29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3	5D1FAB844107676ABCDFC25EAEBCB633	09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827	0010818ED8A666051C6198662C3D6DDE2CA4901DDC	0x25
app	3.55~?	0x0B	3.55++	A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3	E4792F2B9DB30CB8D1596077A13FB3B5	2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF		0x26
app	3.55~?	0x0C	3.55++	9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA	D43B1FA8BE15714B3078C23908BB2BCA	7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB		0x3D
seven	3.55	0x00	3.55 only	BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F	263057225873F83940A65C8C926AC3E4	BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437		0x23
npdrm	3.55	0x0A np	3.55++	03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4	0A99D4D4F8301A88052D714AD2FB565E	3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B		0x27
npdrm	3.55~?	0x0C np	3.55++	357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92	D26E6DD2B74CD78E866E742E5571B84F	00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57		0x3A
app	3.56~?	0x0D	3.56++	03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194	5ADB9EAFE897B54CB1060D6885BE22CF	71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142		0x12
app	3.56~?	0x0E	3.56++	39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03	90266C98CBAA06C1BF145FF760EA1B45	84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255		0x27
app	3.56~?	0x0F	3.56++	FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B	64F50296CF8CF49CD7C643572887DA0B	0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1		0x3A
seven	3.56	0x00	3.56 only	71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B	9DED878CB6BA07121C0F50E7B172A8BF	387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3		0x29
npdrm	3.56	0x0D np	3.56++	337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957	8405C88E042280DBD794EC7E22B74002	9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1		0x18
npdrm	3.56	0x0F np	3.56++	135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291	4070C898C2EAAD1634A288AA547A35A8	BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433		0x3B
app	3.60~3.61	0x10	3.60++	A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F	7A203D5112F799979DF0E1B8B5B52AA4	50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934		0x25
npdrm	3.60~3.61	0x10 np	3.60++	4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61	C0F2AB86E6E0457552DB50D7219371C5	64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213		0x27
app	3.60~3.61	0x11	3.60++	0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD	97AF39C383E7EF1C98FA447C597EA8FE	2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D		0x26
seven	3.60~3.61	0x00	=>3.60 <=3.61	F5D1DBC182F5083CD4EA37C431C7DAC73882C07F232D2699B1DD9FDDF1BF4195	D3A7C3C91CBA014FCBCA6D5570DE13FF	97CA8A9781F45E557E98F176EF794FCDA6B151EB3DFD1ABA12151E00AE59957C3B15628FC8875D28		0x23
app	3.60~3.61	0x12	=>3.60 <=4.11	D127E0F7F31F2546D374E46F26A45F14016308EDB409185187AB7F0B2DEE6715	25589F01B97B9BE1E07447A3CE7F06B9	3C266FF46D1F526405CCCDD67EE9C7D5693B4A072C06988CAD22ADDB64439A32E2337722F51FC15B		0x3D
npdrm	3.60~3.61	0x12 np	=>3.60 <=4.11	D2F32F6E1D7A96131FAECE657008B57AAC14A9475CEF983A55E6C82CF1FCC374	211B52440AB7066A53121106FEB29FD5	EA2F8826D1ECA47B029B41C833615006FAF535AAD30594319EA4F767925EBAE3A3EEE32E6D29580C		0x3A
npdrm	3.65~3.66	0x13 np	3.65++	265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46	8DEA5FF959682A9B98B688CEA1EF4A1D	9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8		0x18
app	3.65~3.66	0x13	3.65++	DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94	CB5DD4BE8CF115FFB25801BC6086E729	B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917		0x12
app	3.65~3.66	0x14	3.65++	491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E	F98843588FED8B0E62D7DDCB6F0CECF4	04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E		0x27
seven	3.65~3.66	0x00	=>3.65 <=3.66	BF10F09590C0152F7EF749FF4B990122A4E8E5491DA49A2D931E72EEB990F860	22C19C5522F7A782AFC547C2640F5BDE	3233BA2B284189FB1687DF653002257A0925D8EB0C64EBBE8CC7DE87F548D107DE1FD3D1D285DB4F		0x29
app	3.65~3.66	0x15	=>3.65 <=4.11	324D2BFEDA4044604EDCA550EB7F56065C4CA91DFB2636EC78030353DC1CEFF4	A37B2139FBCF62F6B41F796A594440C8	A6283C12B04C37DDC6EBBF4B31E5F1B1B2602DC83EBA6362C9C1189BF25A3EF1BB3766625A4E9694		0x3A
npdrm	3.65~3.66	0x15 np	=>3.65 <=4.11	3DED5C82E18CD9F695855B1757CA91447EA34D906A66BEAAB46113F9BCE1D92F	ABF2DA36D993554FB060322DC51097F7	497296C62F2C489F9F0E7628887AD54715EFD1227B053C6AA4501D43FF6FB536B78315C08D786569		0x3B
app	3.70~3.74	0x16	3.70++	A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C	62773C70BD749269C0AFD1F12E73909E	566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF		0x30
npdrm	3.70~3.74	0x16 np	3.70++	7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B	4AD981431B98DFD39B6388EDAD742A8E	62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1		0x25
app	3.70~3.74	0x17	3.70++	4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46	954A86C4629E116532304A740862EF85	3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666		0x08
seven	3.70~3.74	0x00	=>3.70 <=3.74	F11DBD2C97B32AD37E55F8E743BC821D3E67630A6784D9A058DDD26313482F0F	FC5FA12CA3D2D336C4B8B425D679DA55	19E27EE90E33EDAB16B22E688B5F704E5C6EC1062070EBF43554CD03DFDAE16D684BB8B5574DBECA		0x15
app	3.70~3.74	0x18	=>3.70 <=4.11	1F876AB252DDBCB70E74DC4A20CD8ED51E330E62490E652F862877E8D8D0F997	BF8D6B1887FA88E6D85C2EDB2FBEC147	64A04126D77BF6B4D686F6E8F87DD150A5B014BA922D2B694FFF4453E11239A6E0B58F1703C51494		0x11
npdrm	3.70~3.74	0x18 np	=>3.70 <=4.11	1A4B32C927257811F777997EA9549CEFD2AE829A528F771A3EE7FEB2110E0133	402666C76D795D228089810DDC128D14	ABD149AB27BEE0DEC0E34BB8A8CA225E3FCF504E2DDE6A55BBD39A06CFB068CFC3CF5DF8B117EB5A		0x15
app	4.00~4.11	0x19	4.00++	3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297	6153DEE781B8ADDC6A439498B816DC46	148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268		0x31
npdrm	4.00~4.11	0x19 np	4.00++	FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3	F72C1D80FFDA2E3BF085F4133E6D2805	637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42		0x24
app	4.00~4.11	0x1A	4.00++	5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9	1AC8FA3B3C90F8FDE639515F91B58327	BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23		0x17
seven	4.00~4.11	0x00	=>4.00 <=4.11	751EE949CD3ADF50A469197494A1EC358409CCBE6E85217EBDE7A87D3FF1ABD8	23AE4ADA4D3F798DC5ED98000337FF77	1BABA87CD1AD705C462D4E7427B6DAF59A50383A348A15088F0EDFCF1ADF2B5C2B2D507B2A357D36		0x1A
app	4.00~4.11	0x1B	=>4.00 <=4.11	66637570D1DEC098467DB207BAEA786861964D0964D4DBAF89E76F46955D181B	9F7B5713A5ED59F6B35CD8F8A165D4B8	4AB6FB1F6F0C3D9219923C1AC683137AB05DF667833CC6A5E8F590E4E28FE2EB180C7D5861117CFB		0x12
npdrm	4.00~4.11	0x1B np	=>4.00 <=4.11	BCF9BD763A7B787CF1428EF45546AF5EBB3D816ABA1C6FF2FFD3D854B71F355B	D03979E47D236BD278EC7331B7DA0BD4	4F30DF9F3A9D6B3AF92510F81F7961DD404F5E09BFF4D989969727509E39B94A750D12A063189848		0x17
app	4.20~4.91	0x1C	4.20++	CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752	FD40664E2EBBA01BF359B0DCDF543DA4	36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893		0x09
npdrm	4.20~4.91	0x1C np	4.20++	8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F	246F4B8328BE6A2D394EDE20479247C5	503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762		0x30
app	4.20~4.91	0x1D	4.20++	D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E	ACB9945914EBB7B9A31ECE320AE09F2D	430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879		0x1A
seven	4.20~4.91	0x00	4.20++	46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9	BF036387CDB613C0AC88A6D9D2CC5316	A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952		0x0F

AppLdr HMAC Key

A09B58A612B9F4C13451A1B81C94ABF8423ED76A96271A722394F0DD042BA2CAA41A567177A8B500235C74495842BF2007FAF274CC81091AD57AF7264A60E2CE

Used for lv2 memory check.

This key was implemented since 3.55.

Lv1 used lv2ldr to generate the hash when it loads LV2 then used appldr to verify generated hash when it loads self file.

• Location: lv2ldr, appldr inside lv0 (3.61+) outside lv0 (3.55, 3.60)

• Note: unlike some people have stated, there isn't only one section being verified. 7 sections are verified, and these are: core, text, rodata, ctors, toc1, opd and finally toc

• Note: hash value is stored in .bss segment of lv1 and transfered to SPU through the SharedLS.

 typedef struct {
  uint64_t lv2_mem_offset;
  uint64_t hashed_data_size;
  uint8_t[0x14] hmac_hash;
  uint8_t[0x0C] pad;
 } LV2_MEMORY_PROTECTION_ARGUMENTS;

Appldr riv_key

What is this used for?

riv_key: 00000000000000000000000000000000
riv_iv: 00000000000000000000000000000000

• See also :/)
• Location: appldr

NPDRM Keys

See also NPDRM.

See a screenshot of the first retrieved PS3 NPDRM keys files.

NPDRM Activation ECDSA Public Key

npdrm_act_ecdsa_pub_key_x: 6227B00A02856FB04108876719E0A0183291EEB9
npdrm_act_ecdsa_pub_key_y: 6E736ABF81F70EE9161B0DDEB026761AFF7BC85B

• Location: PSP npdrm.prx, PS3, PS Vita npdrm.skprx.

Algorithm: Applies to NPDRM act.dat (Signature at 0x1010, sha1hash previous 0x1010 bytes to validate sig) and to NPDRM .rif (signature at 0x70, hash previous 0x70 bytes to validate signature) . Also applies to ps3 EDATs.

ECDSA curve type: 2 (vsh)

NPDRM PSP EDAT ECDSA Public Key

npdrm_psp_edat_ecdsa_pub_key_x: 1F072BCCC162F2CFAEA0E7F4CDFD9CAEC6C45521
npdrm_psp_edat_ecdsa_pub_key_y: 5301F4E370C3EDE2D4F5DBC3A7DE8CAAE8AD5B7D

ECDSA curve type: 2 (vsh)

• Location: PSP npdrm.prx, ?PS3?, PS Vita npdrm.skprx.

NPDRM PSP EDAT ECDSA Private Key

npdrm_psp_edat_ecdsa_priv_key: E5C4D0A8249A6F27E5E0C9D534F4DA15223F42AD

• Location: Calculated via https://github.com/tpunix/kirk_engine/tree/master/test

NPDRM PSISOIMG0000 ECDSA Public Key

npdrm_psisoimg0000_ecdsa_pub_key_x: 948DA13E8CAFD5BA0E90CE434461BB327FE7E080
npdrm_psisoimg0000_ecdsa_pub_key_y: 475EAA0AD3AD4F5B6247A7FDA86DF69790196773

ECDSA curve type: 2 (vsh)

• Location: ps1_netemu.self (PS3 FW >= 1.70), ps1_newemu.self (PS3 FW >= 2.10)

NPDRM PSISOIMG0000 ECDSA Private Key

npdrm_psisoimg0000_ecdsa_priv_key: 00BF21224B041F29549DB25E9AADE19E720A1FE0F1

• Location: ps1_netemu.self (PS3 FW >= 1.70), ps1_newemu.self (PS3 FW >= 2.10)

This key is used for signing content of the ISO.BIN.EDAT (decrypted form). The signature is located at the tail of the decrypted ISO.BIN.EDAT, its length is 0x28 bytes. See also PSISOIMG0000.

NPDRM NPUMDIMG ECDSA Public Key

npdrm_npumdimg_ecdsa_pub_key_x: 0121EA6ECDB23A3E2375671C5362E8E28B1E783B
npdrm_npumdimg_ecdsa_pub_key_y: 1A2732158B8CED98466C18A3AC3B1106AFB4EC3B

ECDSA curve type: 2 (vsh)

• Location: PSP np9660.prx , ?PS3? (not there?), PS Vita npdrm.skprx.

NPDRM NPUMDIMG ECDSA Private Key

npdrm_npumdimg_ecdsa_priv_key: 14B022E892CF8614A44557DB095C928DE9B89970

• Location: Calculated from 2 different DATA.PSAR with same R (located at 0xD8) (sha1 previous 0xD8 bytes to validate signature)

UP9000-UCUS98721_00-PATAPONPSNDEMO08 R1S1
UP1022-NPUH90004_00-PUZZLEGUZZLEDEMO R1S2

This key is used to sign the NPUMDIMG data inside PSN NPDRM EBOOT.PBP.

There is even a thread asking about the size limitation of the "Bubbles" method: http://www.wololo.net/talk/viewtopic.php?f=54&t=40931.

With this key you no longer need to use a base game to sign your homebrew, so the fake_np EBOOT.PBP size limitation is no longer an issue.

• Source: Hykem

• Application: [sign_np by Hykem updated by Sorgigolova]

NPD CID-FN Hash AES-CMAC Key

Temp name was npdrm-omac1-key-3.

npd_cid_fn_hash_aes_cmac_key: 9B515FEACF75064981AA604D91A54E97

• Location: PS3 OS as it is used in PS3 NPD.

Algorithm: AES-CMAC over 0x30 bytes of CONTENT_ID concatenated with variable-sized NPD-bearing filename.

NPD Header Hash XOR Key

Temp name was npdrm-omac1-key-2.

npd_header_hash_xor_key: 6BA52976EFDA16EF3C339FB2971E256B

• Location: PS3 vsh.self as it is used in PS3 NPD.

Algorithm:

1) Get AES-CMAC Key: (NPD Header Hash AES-CMAC key = npd_header_hash_xor_key XOR klicensee). 2) Compute AES-CMAC on first 0x60 bytes of NPD Header.

EDAT Keys to sort

edat-cypher-key-0:  BE959CA8308DEFA2E5E180C63712A9AE
edat-cypher-key-1:  4CA9C14B01C95309969BEC68AA0BC081
edat-hasher-key-0:  EFFE5BD1652EEBC11918CF7C04D4F011
edat-hasher-key-1:  3D92699B705B073854D8FCC6C7672747

• Location: PS3 appldr.

Since FW 3.60 appldr stores them in scrambled form. key-0 is used for v.1, v.2 and v.3 edats, key-1 is used for v.4 edats.

These keys have to be sorted, and detailed, soon. Also why are there also "edat-key-0 || 4.20" and other 4.20+ EDAT keys on wiki?

ps3_klic_dec_key

ps3_klic_dec_key_old: DC41D59080BFFF45547D0B3A12E591D3

ps3_klic_dec_key: F2FBCA7A75B04EDC1390638CCDFDD1EE

• See: here.

• Location: PS3 appldr. ?Is it also used on PSP/PS Vita?

Algorithm: aes128ecb_decrypt(data = enc_klicensee, key = klic_aes_key, dst = klicensee)

NPDRM Per-console Activation Index AES128ECB key

Temp name was RIF_KEY, actdatidx_dec_key.

npdrm_pcact_index_aes128ecb_key: DA7D4B5E499A4F53B1C1A14A7484443B

• Location: PSP npdrm.prx, PS3 vsh.self, PS Vita npdrm.skprx EKc offset 0x10 in encrypted form and decrypted using kprx_auth_sm.self.

Algorithm: AES128ECB_decrypt(data = rif.enc_metadata, key = npdrm_act_data_index_aes_key, dst = actdat_idx)

Used to decrypt act.dat key index from .rif file at offset 0x40.

Act.dat key (debug)

E8205BCD11573530BE8DED1682936AF6

Unknown purpose, but seems to decrypt the debug section of the act.dat.

• Location: lv2_kernel.self (since PS3 FW 1.80 until firmware 2.10)

NPDRM PSP DRM Free AES128ECB key

npdrm_psp_drm_free_aes128ecb_key: 69B453F2E421898E53E4A35A5B917951

Location: npdrm.prx (PSP FW 6.61).

Algorithm: AES128ECB_encrypt(data = sceMgMemoryStick_driver_735526D6_result, key = npdrm_psp_drm_free_aes128ecb_key, dst = rif_klicensee_dec_key)

Used for DRM Type 3 (Free) when there is no act.dat need but still .rif need. It allows to get the key that decrypts the .rif at offset 0x50 (encrypted klicensee ?=EKc?).

NPDRM IDPS Seed

Temp name was klicensee-const, actdat_key.

npdrm_idps_seed: 5E06E04FD94A71BF0000000000000001

Location: PSP npdrm.prx, PS3 lv2_kernel.self, PS Vita npdrm.skprx EKc offset 0 in encrypted form and decrypted using kprx_auth_sm.self

Algorithm: AES128ECB_encrypt(data = npdrm_idps_seed, key = IDPS, dst = per_console_act_key)

Default NPDRM Licensee Keys

SDAT Klicensee XOR Key

sdat_klicensee_xor_key: 0D655EF8E674A98AB8505CFA7D012933 (SHA1: ED2A015EEB1BD0CE06D0447F1A22AF4C1C401E4A)

• Location: PS3 lv2_kernel.self

Algorithm: sdat_klicensee = (sdat.npd.header_hash XOR sdat_klicensee_xor_key)

PS3 DRM Free klicensee

Temp name was ps3_klic_free_key, npdrm-omac1-key-1, but it is not even an AES-CMAC key, just a licensee key.

klic_ps3_free: 72F990788F9CFF745725F08E4C128387

PSP klicensee

Used as klicensee for PSP ISO.BIN.EDAT and for Minis ISO.BIN.EDAT.

klic_psp: 2A6AFBCF43D1579F7D738741A13BD42E

Location: ?PS3 psp_emulator.self?

PS1 klicensee

Used as klicensee for PS1 ISO.BIN.EDAT.

klic_ps1: 52C0B5CA76D6134BB45FC66CA637F2C1

• Location: PS3 ps1_netemu.self

PSP Remasters klicensee

klic_pe: 0DB85732366CD734FC879E743343BB4F

• Location: PS3 psp_emulator.self

NPDRM PKG AES Keys

NPDRM PKG PS3 AES Keys

npdrm_pkg_ps3_aes_key: 2E7B71D7C9C9A14EA3221F188828B8F8

• Location: nas_plugin.sprx (PS3 FW 0.93-4.88 CEX/DEX/TOOL)

npdrm_pkg_ps3_idu_aes_key: 5DB911E6B7E50A7D321538FD7C66F17B

• Location: nas_plugin.sprx (PS3 FW 2.60 IDU). Maybe present on older/newer PS3 IDU FWs (to check).

NPDRM PKG PSP AES Keys

npdrm_pkg_psp_aes_key: 07F2C68290B50D2C33818D709B60E62B

• Location: nas_plugin.sprx (PS3 FW 3.55 CEX/DEX/TOOL). Maybe present on older/newer PS3 IDU FWs (to check).

npdrm_pkg_psp_idu_aes_key: 7547EE76CA8C55AC1BA8D22535E05593

• Location: nas_plugin.sprx (PS3 FW 2.60 IDU). Maybe present on older/newer PS3 IDU FWs (to check).

Algorithm: Concerns NPDRM PKG that store PSP, Minis, PS1 contents.

NPDRM PKG PS Vita AES Keys

npdrm_pkg_psp2_aes_key: E31A70C9CE1DD72BF3C0622963F2ECCB
npdrm_pkg_psp2_livearea_aes_key: 423ACA3A2BD5649F9686ABAD6FD8801F
npdrm_pkg_psm_aes_key: AF07FD59652527BAF13389668B17D9EA

• Location: somewhere in PS Vita OS.

Algorithm:

• NPDRM PKG AES-CMAC (AES-128-CBC MAC) Hash verification/generation using always npdrm_pkg_ps3_aes_key / npdrm_pkg_ps3_idu_aes_key, whatever the platform is. See PKG files#PKG Digest. PSM PKGs seem to fail both the SHA1 and AES-CMAC digest header checks following the wiki informations but windsurfer's tool might have the solution.

• NPDRM PKG AES-128 decryption/encryption using the per-platform key and per-platform algorithm. AES-128 IV is derived from pkg_data_riv in PKG Header. See PKG_files#Decryption.

NPDRM PKG/SELF ECDSA Public Key

npdrm_pkg_self_ecdsa_pub_x: E6792E446CEBA27BCADF374B99504FD8E80ADFEB
npdrm_pkg_self_ecdsa_pub_y: 3E66DE73FFE58D3291221C65018C038D3822C3C9

ECDSA curve type: 2 (vsh).

• Location: PSP ddrdb.prx sceDdrdb_F013F8BF, PS3 nas_plugin.prx, PS3 download_plugin.prx, PS Vita GameCard Auth Mgr.

Algorithm for NPDRM SELF: To document.

Algorithm for NPDRM PKG:

1) Get a NPDRM .pkg. 2) Get signature: header_npdrm_signature, offset 0x90, size 0x28, PKG header NPDRM ECDSA (R_sig, S_sig) 3) Get data: 0x00-0x7F (or -0x8F) 4) Get public key. 5) Get curve. 6) Verify result.

NPDRM PKG/SELF ECDSA Public Key Bak

• ECDSA Public bak: What is this?

npdrm_pkg_self_ecdsa_pub_bak_x: D9AAEB6054307FC0FB488B15AE11B558C75FC8A3
npdrm_pkg_self_ecdsa_pub_bak_y: EC4907E129C5B5CD386D94D82318B9D558777C5A

ECDSA Curves (VSH)

  curve :    000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
             000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFE000000
             00000000000000000000000000FFFFFFFE00000000000000039A2EB773FCA61DCB5236A42C6F7FEB426E5ADA06
             0000000000000000FFFE4A39E80D6F151E245270DDA65311EAB7634F69577D0F51E30602711A07059FBCA7BA92
             F5E34D6F7216F0D828A37D413EF73F0000000000000000FFFFFFFE00000000000000000000000000000000FFFF
             FFFE00000000000000035974123CCBE7FD63E2C31CC465CDE0334461F0F4000000000000000100004A51C3ADC1
             9C6BB0DED8ED713BDA9B780270209B1DBC843F5E092A5021D3A6A7AA814E24FFED9FBDAADB243C862A53A0B520

 inv_curves: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
             FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
             FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFF
             FFFFFFFFFFFFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC65D1488C0359E234ADC95BD3908014BD91A525F9
             FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA604358456D
             0A1CB2908DE90F27D75C82BEC108C0FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000
             0001FFFFFFFFFFFFFFFCA68BEDC33418029C1D3CE33B9A321FCCBB9E0F0BFFFFFFFFFFFFFFFEFFFFB5AE3C523E
             63944F2127128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C5958557EB1DB001260425524DBC379D5AC5F4ADF

Other representation: https://github.com/balika011/DC-M33/blob/master/psptools/psptool/kirk.py#L158.

• The type 2 curve is used for example for rif/act.dat, most IdStorage Certificates.

Snowden Key

 9DE004E9F2D72F6DE377699BC2E5F83A4C28EEA575DBEAA293F3835E8B7AFA9A 
 16573AD5B0DEEBCCE1A7C54C66B903AE4186FBD7EEB23F16E67A19420B262114 
 08B91715ACC3D1998A37A4639FAFF064E9F90C0FECB28C813FA9F649074C9A33 
 0392EA2B91C3FD3732D1DFED7CA151A21926F0B315107BF1FBEA8929E68AB397

• Location: vsh.elf or vshnet.prx into old firmwares

VSH CryptoEngine HMAC-SHA1 Keys

 key0 685E2534695D79096F57640044315B515E0C7E55
 key1 46753933634D1A1D464142752110116F2C5E7836
 key2 59CB6067574D873CEFD7B75A300529C18BFB75ED
 key3 C699CF88072F6819D5DAFA7A2EEB93E537E0ADE2
 key4 E8ABDAE8F81C086123FE5D6281BB0F0DEE909AF5
 key5 F8A05D44A04E5C036812261DB70EE1708EBC4D48
 key6 A3F58C9913A108BE8C1EDB889C2BF8F7578101DA
 key7 B6627AE4422F9D81E1421FA2B1DB02841E64B933

PS2emu Keys

 MC_CARDKEY_MATERIAL_1  	6C26D37F46EE9DA9 <-mc_iso
 MC_CARDKEY_HASHKEY_1   	CE62F68420B65A81E459FA9A2BB3598A <-mc_iso
 MC_CARDKEY_MATERIAL_2  	2CD160FA8C2ED362 <-mc_iso
 MC_CARDKEY_HASHKEY_2   	7014A32FCC5B1237AC1FBF4ED26D1CC1 <-mc_iso
 MC_CHALLENGE_MATERIAL  	2C5BF48D32749127 <-mc_iso
 MG_KBIT_MATERIAL      	35C860019222BB60 <-me_iso
 MG_KC_MATERIAL        	8C2BD03EC245C56D <-me_iso
 MG_KBIT_MASTER_KEY   	5001C87121F939C144D86B069224B247 <- me_iso
 MG_KC_MASTER_KEY     	77F38314B047D87C9B37D266049228C4 <- me_iso
 META_KEY_RETAIL       389DCBA5203C8159ECF94C9393164CC9 <- sb_iso (key_id 0x18, is not final key, used to encrypt drm_key to create final one)
 DATA_KEY_RETAIL       1017823463F468C1AA41D700B140F257 <- sb_iso (key_id 0x19, is not final key, used to encrypt drm_key to create final one)
 VMC_KEY_RETAIL        64E30D19A16941D677E32EEBE07F45D2 <- sb_iso (key_id 0x1A, final key)
 META_KEY_DEBUG        2B05F7C7AFD1B169D62586503AEA9798 <- sb_iso (key_id 0x15, final key)
 DATA_KEY_DEBUG        74FF7E5D1D7B96943BEFDCFA81FC2007 <- sb_iso (key_id 0x16, final key)
 VMC_KEY_DEBUG         30479D4B80E89E2B59E5C9145E1064A9 <- sb_iso (key_id 0x17, final key)
 MG_SIG_HASH_KEY       65E88B1A9E3FD268 <- me_iso
 MG_SIG_MASTER_KEY     51ED689419A83AD8 <- me_iso
 MG_IV_CONTENT_TABLE   20CB60F58D24BE50 <- me_iso
 MG_ROOTSIG_MASTER_KEY D56604A445781EC4 <- me_iso
 MG_ROOTSIG_HASH_KEY   E773089E35D26A1B38C761029437CEE3 <- me_iso
 MG_IV_BLOCK           7D16C46313C3711C <- me_iso

LV2 Kernel 3Des Key

57C3E792E8D03DC4D2D72DFA4F81FB2889170959

• used in conjuction with ivs_3des

PSPemu and PS1emu Keys

Kirk Keys

Notes:

• Kirk command 0x11 is not vulnerable to retrieval of ECDSA private key. KIRK commmand 1 is.
• Besides Kirk command 1, everything else from the PSP (for example KIRK command 0x11) uses curve type 2 (VSH). Kirk command 1 uses curve type 1.

See also:

• [3]
• [4]
• [5]
• [6]
• [7]
• [8]
• [9]

KIRK command 1 Keys

Kirk command 1 CMAC

// Kirk command 1 AES128-CMAC key
kirk_command_1_cmac_key = 98C940975C1D10E87FE60EA3FD03A8BA

Kirk command 1 ECDSA Keys

// Kirk command 1 ECDSA Private Key
kirk_command_1_ecdsa_priv = F392E26490B80FD889F2D9722C1F34D7274F983D

// Kirk command 1 ECDSA Public Key
// Since public key is hardcoded, it is also included
kirk_command_1_ecdsa_pub_x = ED9CE58234E61A53C685D64D51D0236BC3B5D4B9 
kirk_command_1_ecdsa_pub_y = 049DF1A075C0E04FB344858B61B79B69A63D2C39

Kirk command 0x10 Default ECDSA Keys

// Emulated Kirk command 0x10 ECDSA Default Private Key
kirk_command_0x10_priv_key = 993150A4524E35F4DA5608630E23D959839F53DB

// Emulated Kirk command 0x10 ECDSA Default Public Key
kirk_command_0x10_pub_key_x = 987FBEEE85F85B51BA823267EE1822F20EAC7889
kirk_command_0x10_pub_key_y = 3D4FD43EDE57E615B4636B621037399EB03D0E16

Kirk commands 1, 0x11 - ECC Curves

// Common Curve paramters p and a
ec_p = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF
ec_a = FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC // mon

// Kirk command 1 - Unique curve parameters for b, N and base point G
ec_b1 = 65D1488C0359E234ADC95BD3908014BD91A525F9
ec_N1 = 00FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F
Gx1 = 2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA
Gy1 = 604358456D0A1CB2908DE90F27D75C82BEC108C0

Kirk commands 0xC, 0xD, 0x10, 0x11 - Unique curve parameters for b, N and base point G

Since public key is variable, it is not specified here.

ec_b2 = A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B // mon
ec_N2 = 00FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127
Gx2 = 128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C
Gy2 = 5958557EB1DB001260425524DBC379D5AC5F4ADF

Kirk commands 4 and 7 AES128CBC Keys

2C92E5902B86C106B72EEA6CD4EC7248
058DC80B33A5BF9D5698FAE0D3715E1F
B813C35EC64441E3DC3C16F5B45E6484
9802C4E6EC9E9E2FFC634CE42FBB4668
99244CD258F51BCBB0619CA73830075F
0225D7BA63ECB94A9D237601B3F6AC17
6099F28170560E5F747CB520C0CDC23C
76368B438F77D87EFE5FB6115939885C
14A115EB434A1BA4905E03B617A15C04
E65803D9A71AA87F059D229DAF5453D0
BA3480B428A7CA5F216412F70FBB7323
72AD35AC9AC3130A778CB19D88550B0C
8485C848750843BC9B9AECA79C7F6018
B5B16EDE23A97B0EA17CDBA2DCDEC46E
C871FDB3BCC5D2F2E2D7729DDF826882
0ABB336C96D4CDD8CB5F4BE0BADB9E03
32295BD5EAF7A34216C88E48FF50D371
46F25E8E4D2AA540730BC46E47EE6F0A
5DC71139D01938BC027FDDDCB0837D9D
51DD65F071A4E5EA6AAF12194129B8F4
03763C6865C69B0FFE8FD8EEA43616A0
7D50B85CAF6769F0E54AA8098B0EBE1C
72684B32AC3B332F2A7AFC9E14D56F6B
201D31964AD99FBF32D5D61C491BD9FC
F8D84463D610D12A448E9690A6BB0BAD
5CD4057FA13060440AD9B6745F244F4E
F48AD678599C22C1D411933DF845B893
CAE7D287A2ECC1CD94542B5E1D9488B2
DE26D37A39956C2AD8C3A6AF21EBB301
7CB68B4DA38D1DD932679CA99FFB2852
A0B556B469AB368F36DEC9092ECB41B1
939DE19B725FEEE2452ABC1706D14769
A4A4E621382EF1AF7B177AE842AD0031
C37F13E8CF84DB34747BC3A0F19D3A73
2BF7838AD898E95FA5F901DA61FE35BB
C704621E714A66EA62E04B203DB8C2E5
C933859AAB00CDCE4D8B8E9F3DE6C00F
1842561F2B5F34E3513EB78977431A65
DCB0A0065A50A14E59AC973F1758A3A3
C4DBAE83E29CF254A3DD374E807BF425
BFAEEB498265C57C64B8C17E19064409
797CECC3B3EE0AC03BD8E6C1E0A8B1A4
7534FE0BD6D0C28D68D4E02AE7D5D155
FAB35326974F4EDFE4C3A814C32F0F88
EC97B386B433C6BF4E539D95EBB979E4
B320A204CF480629B5DD8EFC98D4177B
5DFC0D4F2C39DA684A3374ED4958A73A
D75A5422CED9A3D62B557D8DE8BEC7EC
6B4AEE4345AE7007CF8DCF4E4AE93CFA
2B522F664C2D114CFE61318C56784EA6
3AA34E44C66FAF7BFAE55327EFCFCC24
2B5C78BFC38E499D41C33C5C7B2796CE
F37EEAD2C0C8231DA99BFA495DB7081B
708D4E6FD1F66F1D1E1FCB02F9B39926
0F6716E180699C51FCC7AD6E4FB846C9
560A494A844C8ED982EE0B6DC57D208D
12468D7E1C42209BBA5426835EB03303
C43BB6D653EE67493EA95FBC0CED6F8A
2CC3CF8C2878A5A663E2AF2D715E86BA
833DA70CED6A2012D196E6FE5C4D37C5
C743D06742EE90B8CA75503520ADBCCE
8AE3663F8D9E82A1EDE68C9CE8256DAA
7FC96F0BB1485CA55DD364B77AF5E4EA
91B765788BCB8BD402ED553A6662D0AD
2824F9101B8D0F7B6EB263B5B55B2EBB
30E2575DE0A249CEE8CF2B5E4D9F52C7
5EE50439623202FA85393F72BB77FD1A
F88174B1BDE9BFDD45E2F55589CF46AB
7DF49265E3FAD678D6FE78ADBB3DFB63
747FD62DC7A1CA96E27ACEFFAA723FF7
1E58EBD065BBF168C5BDF746BA7BE100
24347DAF5E4B35727A52276BA05474DB
09B1C705C35F536677C0EB3677DF8307
CCBE615C05A20033378E5964A7DD703D
0D4750BBFCB0028130E184DEA8D48413
0CFD679AF9B4724FD78DD6E99642288B
7AD31A8B4BEFC2C2B39901A9FE76B987
BE787817C7F16F1AE0EF3BDE4CC2D786
7CD8B891910A4314D0533DD84C45BE16
32722C8807CF357D4A2F511944AE68DA
7E6BBFF6F687B898EEB51B3216E46E5D
08EA5A8349B59DB53E0779B19A59A354
F31281BFE69F51D164082521FFBB2261
AFFE8EB13DD17ED80A61241C959256B6
92CDB4C25BF2355A2309E819C9144235
E1C65B226BE1DA02BA18FA21349EF96D
14EC76CE97F38A0A34506C539A5C9AB4
1C9BC490E3066481FA59FDB600BB2870
43A5CACC0D6C2D3F2BD989676B3F7F57
00EFFD1808A405893C38FB2572706106
EEAF49E009879BEFAAD6326A3213C429
8D26B90F431DBB08DB1DDAC5B52C92ED
577C3060AE6EBEAE3AAB1819C571680B
115A5D20D53A8DD39CC5AF410F0F186F
0D4D51AB2379BF803ABFB90E75FC14BF
9993DA3E7D2E5B15F252A4E66BB85A98
F42830A5FB0D8D760EA671C22BDE669D
FB5FEB7FC7DCDD693701979B29035C47
02326AE7D396CE7F1C419DD65207ED09
9C9B1372F8C640CF1C62F5D592DDB582
03B302E85FF381B13B8DAA2A90FF5E61
BCD7F9D32FACF847C0FB4D2F309ABDA6
F55596E97FAF867FACB33AE69C8B6F93
EE297093F94E445944171F8E86E170FC
E434520CF088CFC8CD781B6CCF8C48C4
C1BF66818EF953F2E1266B6F550CC9CD
560FFF8F3C9649144516F1BCBFCEA30C
2408DC753760A29F0554B5F243857399
DDD5B56A59C55AE83B9667C75C2AE2DC
AA686772E02D44D5CDBB6504BCD5BF4E
1F17F014E777A2FE4B136B56CD7EF7E9
C93548CF558D7503896B2EEB618CA902
DE34C541E7CA86E8BEA7C31CECE4360F
DDE5FF551B74F6F4E016D7AB22311B6A
B0E93521333FD7BAB4762CCB4D8008D8
381469C4C3F91B9633638E4D5F3DF029
FA486AD98E6716EF6AB087F589457F2A
321A091250148A3E963DEA025932E18F
4B00BE29BCB02864CEFD43A96FD95CED
577DC4FF0244E28091F4CA0A7569FDA8
835336C61803E43E4EB30F6B6E799B7A
5C9265FD7B596AA37A2F509D85E927F8
9A39FB89DF55B2601424CEA6D9650A9D
8B75BE91A8C75AD2D7A594A01CBB9591
95C21B8D05ACF5EC5AEE77812395C4D7
B9A461643633FA5D9488E2D3281E01A2
B8B084FB9F4CFAF730FE7325A2AB897D
5F8C179FC1B21DF1F6367A9CF7D3D47C

// KIRK Unknown PS3 Key
kirk_unk100 = 000102030405060708090A0B0C0D0E0F

PSP PCK Master Key

psp_idstorage_master_key = 475E09F4A237DA9BEFFF3BC077143D8A

• Can be found probably in PS3 PSPemu (Kirk command 16 emulation) and in Kicho Dencho Factory NAND Dump, inside one of the modules.

• Used to generate the perconsole keys necessary for kirk 5, 6, 8, 9, 0xA, 0xF, 0x10, 0x12 commands.

• Named idskey0 in Despertar Del Cementerio source code.

DOCUMENT.DAT

des key: 39F7EFA16CCE5F4C
des iv: A819C4F5E154E30B

• Location: ps1_netemu.self

CHNNLSV SaveData keys

sdHashKey1 = 40E6533F05113A4EA14BDAD6727C534C
sdHashKey2 = FAAA50EC2FDE5493AD14B2CEA53005DF
sdHashKey3 = 36A53EACC5269EA383D9EC256C484872
sdHashKey4 = D8C0B0F33E6B7685FDFB4D7D451E9203
sdHashKey5 = CB15F407F96A523C04B9B2EE5C53FA86
sdHashKey6 = 7044A3AEEF5DA5F2857FF2D694F5363B
sdHashKey7 = EC6D29592635A57F972A0DBCA3263300

AMCTRL keys

amHashKey1 = 9C48B62840E6533F05113A4E65E63A64
amHashKey2 = 70B47BC0A14BDAD6E01014ED727C534C
amHashKey3 = E350ED1D910A1FD029BB1C3EF34077FB
amHashKey4 = 135FA47CAB395BA476B8CCA98F3A0445
amHashKey5 = 678D7FA32A9CA0D1508AD8385E4B017E

PEmuCoreLib Key (3DES)

erk: EF690EC0E0BFA41F08455BD038EB8762DA3923EF9C61B930
riv: 2DEE8950969112D9

Idpstealer Key?

• DES encrypt 192? bit

key: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E
iv: 0000000000000000

• Location: explore_plugin.sprx, vsh.self

Idpstealer Key Confusion

• usage: idpstealer.exe idps.bin
• output: SID_KEY: 5E5B43EF9BC2CD75B0F2AEF7FD3B199762D6C13280E50D3E

TMDB Key

• This is a HMAC-SHA1 key.

F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197CF1AED3B7E9671EEB56CA6753C2E6B0

• Location: explore_plugin.sprx

It is used to generate URLs to obtain Title infos.

For example, title_id: BLES01133

Seed will contain BLES01133_00

openssl dgst -mac hmac -macopt hexkey:F5DE66D2680E255B2DF79E74F890EBF349262F618BCAE2A9ACCDEE5156CE8DF2CDF2D48C71173CDC2594465B87405D197

CF1AED3B7E9671EEB56CA6753C2E6B0 -sha1 seed

HMAC-SHA1(seed.bin) = 93ec11e04b137b433a9c867603e64660782a762e

URL will be: http://tmdb.np.dl.playstation.net/tmdb/BLES01133_00_93EC11E04B137B433A9C867603E64660782A762E/BLES01133_00.xml

Sbox Values

D/L	hex	Note
	S-box (You can read more about this here http://en.wikipedia.org/wiki/Rijndael_S-box) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00018F80 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 c|w{òkoÅ0.g+þ׫v 00018F90 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 Ê‚É}úYGð­Ô¢¯œ¤rÀ 00018FA0 B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15 ·ý“&6?÷Ì4¥åñqØ1. 00018FB0 04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75 .Ç#Ã.–.š..€âë'²u 00018FC0 09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84 .ƒ,..nZ R;Ö³)ã/„ 00018FD0 53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF SÑ.í ü±[j˾9JLXÏ 00018FE0 D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8 ÐïªûCM3…Eù..P<Ÿ¨ 00018FF0 51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2 Q£@.’.8õ¼¶Ú!.ÿóÒ 00019000 CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73 Í..ì_—D.ħ~=d].s 00019010 60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB `.OÜ"*.ˆFî¸.Þ^.Û 00019020 E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79 à2:.I.$\ÂÓ¬b‘•äy 00019030 E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08 çÈ7m.ÕN©lVôêez®. 00019040 BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A ºx%..¦´ÆèÝt.K½‹Š 00019050 70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E p>µfH.ö.a5W¹†Á.ž 00019060 E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF áø˜.iÙŽ”›.‡éÎU(ß 00019070 8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16 Œ¡‰.¿æBhA™-.°T».	Present in all SPU binaries that perform AES (see here)
	Inverse AES S-box Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 008633C0 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB R.jХ06Ґ8ї@ЈћЃуЧы 008633D0 7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB |г9‚›/я‡4ЋCDДЮйЛ 008633E0 54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E T{”2¦В#=оL•.BъГN 008633F0 08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25 ..Ўf(Щ$Іv[ўIm‹С% 00863400 72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92 rшцd†h..Ф¤\М]e¶’ 00863410 6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84 lpHPэн№Ъ^.FW§Ќќ„ 00863420 90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06 ђШ«.ЊјУ.чдX.ёіE. 00863430 D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B Р,.ЏК?..БЇЅ...Љk 00863440 3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73  :‘.AOgЬк—тПОрґжs 00863450 96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E –¬t"з.5…вщ7и.uЯn 00863460 47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B Gс.q.)Е‰o·b.Є.ѕ. 00863470 FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4 ьV>KЖТy љЫАюxНZф 00863480 1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F .ЭЁ3€.З1±..Y'Ђм_ 00863490 60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF `Q.©.µJ.-еzџ“Йњп 008634A0 A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61 а;M®*х°Ил»<ѓS™a 008634B0 17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D .+.~єwЦ&бi.cU!.}
	DES Sbox 1 01 01 04 00 00 00 00 00 00 01 00 00 01 01 04 04 01 01 00 04 00 01 04 04 00 00 00 04 00 01 00 00 00 00 04 00 01 01 04 00 01 01 04 04 00 00 04 00 01 00 04 04 01 01 00 04 01 00 00 00 00 00 00 04 00 00 04 04 01 00 04 00 01 00 04 00 00 01 04 00 00 01 04 00 01 01 00 00 01 01 00 00 01 00 04 04 00 01 00 04 01 00 00 04 01 00 00 04 00 01 00 04 00 00 00 00 00 00 04 04 00 01 04 04 01 00 00 00 00 01 00 00 01 01 04 04 00 00 00 04 01 01 00 00 01 01 04 00 01 00 00 00 01 00 00 00 00 00 04 00 01 01 00 04 00 01 00 00 00 01 04 00 01 00 00 04 00 00 04 00 00 00 00 04 01 00 04 04 00 01 04 04 01 01 04 04 00 01 00 04 01 01 00 00 01 00 04 04 01 00 00 04 00 00 04 04 00 01 04 04 01 01 04 00 00 00 04 04 01 00 04 00 01 00 04 00 00 00 00 00 00 01 00 04 00 01 04 00 00 00 00 00 01 01 00 04

Plain SBOX values

Forward

63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76
CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0
B7 FD 93 26 36 3F F7 CC 34 A5 E5 F1 71 D8 31 15
04 C7 23 C3 18 96 05 9A 07 12 80 E2 EB 27 B2 75
09 83 2C 1A 1B 6E 5A A0 52 3B D6 B3 29 E3 2F 84
53 D1 00 ED 20 FC B1 5B 6A CB BE 39 4A 4C 58 CF
D0 EF AA FB 43 4D 33 85 45 F9 02 7F 50 3C 9F A8
51 A3 40 8F 92 9D 38 F5 BC B6 DA 21 10 FF F3 D2
CD 0C 13 EC 5F 97 44 17 C4 A7 7E 3D 64 5D 19 73
60 81 4F DC 22 2A 90 88 46 EE B8 14 DE 5E 0B DB
E0 32 3A 0A 49 06 24 5C C2 D3 AC 62 91 95 E4 79
E7 C8 37 6D 8D D5 4E A9 6C 56 F4 EA 65 7A AE 08
BA 78 25 2E 1C A6 B4 C6 E8 DD 74 1F 4B BD 8B 8A
70 3E B5 66 48 03 F6 0E 61 35 57 B9 86 C1 1D 9E
E1 F8 98 11 69 D9 8E 94 9B 1E 87 E9 CE 55 28 DF
8C A1 89 0D BF E6 42 68 41 99 2D 0F B0 54 BB 16

Inverse

52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB
7C E3 39 82 9B 2F FF 87 34 8E 43 44 C4 DE E9 CB
54 7B 94 32 A6 C2 23 3D EE 4C 95 0B 42 FA C3 4E
08 2E A1 66 28 D9 24 B2 76 5B A2 49 6D 8B D1 25
72 F8 F6 64 86 68 98 16 D4 A4 5C CC 5D 65 B6 92
6C 70 48 50 FD ED B9 DA 5E 15 46 57 A7 8D 9D 84
90 D8 AB 00 8C BC D3 0A F7 E4 58 05 B8 B3 45 06
D0 2C 1E 8F CA 3F 0F 02 C1 AF BD 03 01 13 8A 6B
3A 91 11 41 4F 67 DC EA 97 F2 CF CE F0 B4 E6 73
96 AC 74 22 E7 AD 35 85 E2 F9 37 E8 1C 75 DF 6E
47 F1 1A 71 1D 29 C5 89 6F B7 62 0E AA 18 BE 1B
FC 56 3E 4B C6 D2 79 20 9A DB C0 FE 78 CD 5A F4
1F DD A8 33 88 07 C7 31 B1 12 10 59 27 80 EC 5F
60 51 7F A9 19 B5 4A 0D 2D E5 7A 9F 93 C9 9C EF
A0 E0 3B 4D AE 2A F5 B0 C8 EB BB 3C 83 53 99 61
17 2B 04 7E BA 77 D6 26 E1 69 14 63 55 21 0C 7D  

In another form (from updater in ebootroms): dead links.

RCON

 01 00 00 00 01 00 00 00  01 00 00 00 01 00 00 00
 02 00 00 00 02 00 00 00  02 00 00 00 02 00 00 00
 04 00 00 00 04 00 00 00  04 00 00 00 04 00 00 00
 08 00 00 00 08 00 00 00  08 00 00 00 08 00 00 00
 10 00 00 00 10 00 00 00  10 00 00 00 10 00 00 00
 20 00 00 00 20 00 00 00  20 00 00 00 20 00 00 00
 40 00 00 00 40 00 00 00  40 00 00 00 40 00 00 00
 80 00 00 00 80 00 00 00  80 00 00 00 80 00 00 00
 1B 00 00 00 1B 00 00 00  1B 00 00 00 1B 00 00 00
 36 00 00 00 36 00 00 00  36 00 00 00 36 00 00 00

Shuffles

 00 01 02 03 04 05 06 07  08 09 0A 0B 0C 0D 0E 0F
 01 02 03 04 05 06 07 08  09 0A 0B 0C 0D 0E 0F 10
 02 03 04 05 06 07 08 09  0A 0B 0C 0D 0E 0F 10 11
 03 04 05 06 07 08 09 0A  0B 0C 0D 0E 0F 10 11 12
 04 05 06 07 08 09 0A 0B  0C 0D 0E 0F 10 11 12 13
 05 06 07 08 09 0A 0B 0C  0D 0E 0F 10 11 12 13 14
 06 07 08 09 0A 0B 0C 0D  0E 0F 10 11 12 13 14 15
 07 08 09 0A 0B 0C 0D 0E  0F 10 11 12 13 14 15 16
 08 09 0A 0B 0C 0D 0E 0F  10 11 12 13 14 15 16 17
 09 0A 0B 0C 0D 0E 0F 10  11 12 13 14 15 16 17 18
 0A 0B 0C 0D 0E 0F 10 11  12 13 14 15 16 17 18 19
 0B 0C 0D 0E 0F 10 11 12  13 14 15 16 17 18 19 1A
 0C 0D 0E 0F 10 11 12 13  14 15 16 17 18 19 1A 1B
 0D 0E 0F 10 11 12 13 14  15 16 17 18 19 1A 1B 1C
 0E 0F 10 11 12 13 14 15  16 17 18 19 1A 1B 1C 1D
 0F 10 11 12 13 14 15 16  17 18 19 1A 1B 1C 1D 1E
 10 11 12 13 14 15 16 17  18 19 1A 1B 1C 1D 1E 1F

ShiftRows tab

 00 05 0A 0F 04 09 0E 03  08 0D 02 07 0C 01 06 0B
 05 0A 0F 00 09 0E 03 04  0D 02 07 08 01 06 0B 0C
 0A 0F 00 05 0E 03 04 09  02 07 08 0D 06 0B 0C 01
 0F 00 05 0A 03 04 09 0E  07 08 0D 02 0B 0C 01 06

InvShiftRows tab

 00 0D 0A 07 04 01 0E 0B  08 05 02 0F 0C 09 06 03
 0D 0A 07 00 01 0E 0B 04  05 02 0F 08 09 06 03 0C
 0A 07 00 0D 0E 0B 04 01  02 0F 08 05 06 03 0C 09
 07 00 0D 0A 0B 04 01 0E  0F 08 05 02 03 0C 09 06

Td0/Te1

See [this] and AES binaries with sbox repeated 4 times.

T5

• Location: PS3 lv2_kernel.self

• See this

Disc id for HDD

D1C1E10B9C547E689B805DCD9710CE8D

• Used for hdd-boot game saves as hashkey.

• Location: ss_server1.fself in lv1